MAL-2026-14218

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mapkit-loader/MAL-2026-14218.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14218
Published
2026-08-19T03:16:17Z
Modified
2026-08-19T03:30:15.955405514Z
Summary
Malicious code in mapkit-loader (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (cb2d3c3e234b52b2bbffe7b197f9ec483b2b574667543338b975c99831633c86)

Unscoped npm package 'mapkit-loader' impersonates the scoped '@apple/mapkit-loader' to intercept mistyped npx mapkit-loader invocations. The package.json self-describes as a 'PoC' targeting that confusion. On npm install, the postinstall lifecycle script (postinstall.js) unconditionally issues an HTTPS POST to a hardcoded third-party endpoint at npx-monitor-76056.azurewebsites.net/api/pingback carrying a persistent UUID, package version, trigger source ('npm-postinstall'), and timestamp. The UUID is written to ~/.cache/.mapkit-loader-id so subsequent executions (including the bin entry) can be correlated back to the same host. No credential or filesystem exfiltration is present, but the combination of name-confusion targeting an official Apple scope plus install-time beaconing to an author-controlled endpoint is a supply-chain typosquat with an operational tracking channel.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T03:24:22.020084565Z",
            "sha256": "cb2d3c3e234b52b2bbffe7b197f9ec483b2b574667543338b975c99831633c86",
            "modified_time": "2026-08-19T03:16:17Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018322",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / mapkit-loader

Package

Name
mapkit-loader
View open source insights on deps.dev
Purl
pkg:npm/mapkit-loader

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mapkit-loader/MAL-2026-14218.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "1871b3c432015c5575b6a7cfe7feaa54ae9ffaa60b6fc0717c097f8d30f5fc66",
            "path": "package.json",
            "tlsh": "b4f059208961dd2331c895ce4c261d05eaf11b172144a81a23d7500ccbddda6a1feb1f"
        },
        {
            "sha256": "a9037d7f70543fe7bf422c6a5f641e7a88e6fc6cc49d98ea9a6b7f765aa3e491",
            "path": "postinstall.js",
            "tlsh": "024123b51ed49a302ef6c696e99a9c037317eb52311371b072cd1b2e97c68441052bef"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]