{"id":"MAL-2026-18373","revision":"f42c9af0c2604e0bab0fe96f738a7ec7","records":[{"revision":"f42c9af0c2604e0bab0fe96f738a7ec7","observedAt":"2026-10-29T09:48:08.617+00:00","statement":{"source":"osv","id":"MAL-2026-18373","aliases":[],"title":"Malicious code in @zmtcdn/ui (npm)","description":"@zmtcdn/ui 9999.0.0 and 9999.0.7 are dependency-confusion packages with an empty `index.js` and a description of \"Security research PoC\". Their postinstall script runs `node postinstall.js` on npm install, which POSTs the hostname, username, platform, working directory and the names of all environment variables to `https://www.hinny.shop/api`. They were published by the npm account kill_shs, which also published @zmtcdn/components with the same script.","state":0,"publishedAt":"2026-10-28T07:27:15+00:00","modifiedAt":"2026-10-29T09:15:04.9909214+00:00","affected":[{"ecosystem":"npm","name":"@zmtcdn/ui","ranges":[],"versions":["9999.0.0","9999.0.7"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/@zmtcdn/ui"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-18373","license":"OSV · upstream source license applies","key":"osv:MAL-2026-18373","identifiers":["MAL-2026-18373"]},"retained":false,"historicalAffected":[]}],"coverage":[]}