{"id":"MAL-2026-18373","revision":"7a89153c3ba54187af581426eac688b5","records":[{"revision":"7a89153c3ba54187af581426eac688b5","observedAt":"2026-10-29T15:12:22.973+00:00","statement":{"source":"osv","id":"MAL-2026-18373","aliases":[],"title":"Malicious code in @zmtcdn/ui (npm)","description":"@zmtcdn/ui 9999.0.0 and 9999.0.7 are dependency-confusion packages with an empty `index.js` and a description of \"Security research PoC\". Their postinstall script runs `node postinstall.js` on npm install, which POSTs the hostname, username, platform, working directory and the names of all environment variables to `https://www.hinny.shop/api`. They were published by the npm account kill_shs, which also published @zmtcdn/components with the same script.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e648b4f06d9e84a66379d2b099f89a9d669aa5f21f0159ceed861a37c590262f)\nThe postinstall.js lifecycle script runs automatically on `npm install` and collects installer-identifying data — `os.hostname()`, `os.platform()`, `os.userInfo().username`, `process.cwd()`, the list of `process.env` key names, and a timestamp — then POSTs the JSON blob via `https.request` to the hardcoded endpoint https://www.hinny.shop/api. The package name uses a vendor-style scope (`@zmtcdn/ui`) and an implausibly high version (9999.0.7) consistent with a dependency-confusion lure, and the fetch destination is unrelated to any declared publisher. No user opt-in, no documentation of the beacon, and no legitimate functional purpose for sending this data off-host at install time.\n","state":0,"publishedAt":"2026-10-28T07:27:15+00:00","modifiedAt":"2026-10-29T14:30:31.3761179+00:00","affected":[{"ecosystem":"npm","name":"@zmtcdn/ui","ranges":[],"versions":["9999.0.0","9999.0.7"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/@zmtcdn/ui","https://www.npmjs.com/package/@zmtcdn/ui/v/9999.0.0","https://www.npmjs.com/package/@zmtcdn/ui/v/9999.0.7"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-18373","license":"OSV · upstream source license applies","key":"osv:MAL-2026-18373","identifiers":["MAL-2026-18373"]},"retained":false,"historicalAffected":[]}],"coverage":[]}