Malicious code in @ppa-web-components/ppa-builder (npm)

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (132a763229562f58056a9865006e3645b39657374a953534c63474e8ad54f8be) The package is a shim with no functional code: its main module exports a Proxy that returns a no-op function for every property, so any import of the scoped name succeeds silently. A postinstall script (beacon.cjs) and the main module both POST host-identifying data — package name, os.hostname(), __dirname install path, process.cwd(), and process.version — to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plain HTTP. The beacon fires automatically on npm install via the postinstall lifecycle hook and again on require() of the main entry, with no opt-in and no documentation. The destination is not a first-party or vendor-affiliated host, and the scoped name resembles a legitimate component library, consistent with a dependency-confusion / typosquat reconnaissance beacon.

Source published

25 Oct 2026 14:39:39 UTC

Source modified

25 Oct 2026 14:45:04 UTC

Observed here

25 Oct 2026 15:17:13 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.