Malicious code in @capsense/ccx-welcome-page (npm)

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (0f63b73ae5e707b0eecee16f97f8ab26b350d135547448fbf6e005ba33303060) The package publishes under the @capsense scope at version 99.99.100 and wires all three npm lifecycle hooks (preinstall, install, postinstall) to run beacon.js. beacon.js collects os.hostname(), os.userInfo(), and os.platform() and sends the installer's hostname, username, and OS to two hardcoded attacker-controlled collectors: a DNS lookup against the Interactsh OAST subdomain dbf2v9d8dg559apcd93guf6i7uxrn5coo.oast.pro and an HTTPS GET to webhook.site/59675304-bec1-4ca0-8409-8d37b65ec116 with the host identity in the query string. The scope+version combination (public @capsense scope, implausibly high 99.99.100) is the canonical dependency-confusion shape, intended to override a private internal @capsense package during resolution and fire the beacon on any internal build that pulls the public version. The self-label as a 'dependency-confusion PoC' does not change the behavior: any installer whose build resolves this package has their host identity shipped to third-party collectors without consent. ## Source: ossf-package-analysis (08a76d2425b34728eb502d47ba660eefd26e944864de58d8022e82c367dd55b2) The OpenSSF Package Analysis project identified '@capsense/ccx-welcome-page' @ 99.99.100 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

Source published

25 Oct 2026 18:19:29 UTC

Source modified

26 Oct 2026 06:45:16 UTC

Observed here

26 Oct 2026 07:21:08 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.