Malicious code in @capsense/core-ui (npm)

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (cd830a923fd6fbe61525c9d152a75384cbd42624a45edc957c2f055ff8fa61a8) @capsense/[email protected] is published to the public npm registry under a scoped name at an implausibly high version, a shape used to override an organization's internal package of the same scope during resolution. The package's package.json declares preinstall, install, and postinstall lifecycle scripts that all invoke `node beacon.js`. beacon.js uses `os.hostname()`, `os.userInfo()`, and `os.platform()` to collect the installer's hostname, username, and platform, and transmits those identifiers to two attacker-controlled collectors: a subdomain of oast.pro (dbf2v9d8dg559apcd93guf6i7uxrn5coo.oast.pro) via DNS lookup and HTTPS GET, and webhook.site via query string. The beacon fires automatically on every `npm install`, before any code review of the package contents. Framing in the package description as a disclosure/PoC does not change the behavior: a successful dependency-confusion resolution causes installer-identifying data to leave the build or developer machine to third-party endpoints the installer did not configure. ## Source: ossf-package-analysis (8392b3f36f3576b4ce8308df7d98e3cfd6b68b6873116743a022c9940ee4515d) The OpenSSF Package Analysis project identified '@capsense/core-ui' @ 99.99.100 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

Source published

25 Oct 2026 18:54:07 UTC

Source modified

26 Oct 2026 06:45:15 UTC

Observed here

26 Oct 2026 07:21:08 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.