MAL-2026-13620

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@catamania/front-components/MAL-2026-13620.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13620
Published
2026-08-07T17:07:40Z
Modified
2026-08-07T17:34:49.393584611Z
Summary
Malicious code in @catamania/front-components (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (49b66b93df02350bdf848ac2cff8c6a563ac36c1828480891381875453be67f5)

The package's postinstall.js runs automatically on npm install and collects host reconnaissance data — os.hostname(), os.userInfo() username, process.cwd(), and the list of environment variable names from process.env — then POSTs the JSON payload via https.request to a hardcoded webhook.site capture URL (webhook.site/4b333dc6-9783-4f6b-82fa-db9795caa938). Environment variable values are masked but key names and host identifiers still leave the installer's machine on every install. The package's index.js contains only a trivial 5-line Vue button component, which does not correspond to the install-time beaconing behavior; the shape is consistent with a scoped dependency-confusion or reconnaissance probe measuring which internal build hosts resolve the @catamania scope to the public registry.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017120",
            "import_time": "2026-08-07T17:23:16.832280946Z",
            "sha256": "49b66b93df02350bdf848ac2cff8c6a563ac36c1828480891381875453be67f5",
            "modified_time": "2026-08-07T17:07:40Z",
            "versions": [
                "1.0.5"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / @catamania/front-components

Package

Name
@catamania/front-components
View open source insights on deps.dev
Purl
pkg:npm/%40catamania/front-components

Affected ranges

Affected versions

1.*
1.0.5

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-SsCkBlqhf//cuarQ9eoIhnYr5HAfqMC7eA+LoTTbcfS5vIgR72mU3SXKGTrywvDPYMMXv5qUrRQxkNU2bAEvPg==",
                "sha1": "56ae673295a155f84c233bef4d3d2dbed8ea5c92"
            },
            "filename": "front-components-1.0.5.tgz"
        }
    ],
    "evidence_files": [
        {
            "sha256": "260c98caffc90f037cb4f3f642c90861aa69253bc2e45f87ec604225272c2069",
            "path": "postinstall.js",
            "tlsh": "23017bf491b396501ff5a1c4a484dc07516bd201760778b0b6d44399af94af818b18e5"
        },
        {
            "path": "package.json",
            "sha256": "5d4d9f8959e93b4d9f9b1164394e61352588d5e6396c79efda7f603fe7139062",
            "tlsh": "ccd012701c50766378c90a664a33554f55f14d2e6105b41c17d760b443cb6bbd8ab32e"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@catamania/front-components/MAL-2026-13620.json"