{"schema_version":"1.9.2","id":"MAL-2026-18373","published":"2026-10-28T07:27:15Z","modified":"2026-10-29T14:30:31.376117850Z","summary":"Malicious code in @zmtcdn/ui (npm)","details":"@zmtcdn/ui 9999.0.0 and 9999.0.7 are dependency-confusion packages with an empty `index.js` and a description of \"Security research PoC\". Their postinstall script runs `node postinstall.js` on npm install, which POSTs the hostname, username, platform, working directory and the names of all environment variables to `https://www.hinny.shop/api`. They were published by the npm account kill_shs, which also published @zmtcdn/components with the same script.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e648b4f06d9e84a66379d2b099f89a9d669aa5f21f0159ceed861a37c590262f)\nThe postinstall.js lifecycle script runs automatically on `npm install` and collects installer-identifying data — `os.hostname()`, `os.platform()`, `os.userInfo().username`, `process.cwd()`, the list of `process.env` key names, and a timestamp — then POSTs the JSON blob via `https.request` to the hardcoded endpoint https://www.hinny.shop/api. The package name uses a vendor-style scope (`@zmtcdn/ui`) and an implausibly high version (9999.0.7) consistent with a dependency-confusion lure, and the fetch destination is unrelated to any declared publisher. No user opt-in, no documentation of the beacon, and no legitimate functional purpose for sending this data off-host at install time.\n","affected":[{"package":{"name":"@zmtcdn/ui","ecosystem":"npm","purl":"pkg:npm/%40zmtcdn/ui"},"versions":["9999.0.0","9999.0.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"8bbd4c1f109d109d0953fb78d35c0483207a049d0220e3470d22b6d2403d1be6","tlsh":"10f0ddf162b0e6b46fb991c0e085a80243a3e010f70778e4f8d405983bc5abc0971de8"}],"package_integrity":[{"filename":"ui-9999.0.0.tgz","hashes":{"sha1":"9f74358e4ce6c8dd9bdef85971df54198980ed1d","sha512_sri":"sha512-AxwRblIksjv2d81tSJKfYnN6o0CiLQoXTS6Zxzq0OYHkau9D586m0p3J4VYiGD11gQMhkTh+SDkXvnrU0RD4FA=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zmtcdn/ui/MAL-2026-18373.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@zmtcdn/ui"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@zmtcdn/ui/v/9999.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@zmtcdn/ui/v/9999.0.7"}],"database_specific":{"iocs":{"domains":["hinny.shop"],"files":[{"digests":{"sha256":"89d6f6810a40838b4a82e4f8be92f9f22541707ecef8e856ebf522ab0a3b9053"},"note":"postinstall runs `node postinstall.js`, which POSTs host details to a collector (@zmtcdn/ui@9999.0.0).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"8bbd4c1f109d109d0953fb78d35c0483207a049d0220e3470d22b6d2403d1be6"},"note":"Executed by the postinstall script of @zmtcdn/ui@9999.0.0.","paths":["postinstall.js"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"f1b913f1a0e6d98c104fd8c37fc9569e72a25ee521c9be1a3745cac57c699693"},"note":"postinstall runs `node postinstall.js`, which POSTs host details to a collector (@zmtcdn/ui@9999.0.7).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"8bbd4c1f109d109d0953fb78d35c0483207a049d0220e3470d22b6d2403d1be6"},"note":"Executed by the postinstall script of @zmtcdn/ui@9999.0.7.","paths":["postinstall.js"],"source":"PACKAGE_ARCHIVE"}],"urls":["https://www.hinny.shop/api"]},"malicious-packages-origins":[{"id":"IN-MAL-2026-022028","import_time":"2026-10-29T14:14:18.979289492Z","modified_time":"2026-10-29T13:39:26Z","sha256":"3ea39aaa60f5b1e02e9c92bcb2ef7dd14ab006b973714641d00c7ac9211e2287","source":"amazon-inspector","versions":["9999.0.0"]},{"id":"IN-MAL-2026-022027","import_time":"2026-10-29T14:14:18.903109931Z","modified_time":"2026-10-29T13:39:19Z","sha256":"e648b4f06d9e84a66379d2b099f89a9d669aa5f21f0159ceed861a37c590262f","source":"amazon-inspector","versions":["9999.0.7"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}