MAL-2026-16477

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/com.apple.unityplugin.storekit/MAL-2026-16477.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16477
Published
2026-09-23T14:10:47Z
Modified
2026-09-23T14:30:05Z
Summary
Malicious code in com.apple.unityplugin.storekit (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (920277566757bdc38563c7e2150e906790478cbd7a0c48f0bb53004e82eec4ca)

The package impersonates an Apple/Unity StoreKit internal namespace (com.apple.unityplugin.storekit) and, on require(), index.js performs an HTTPS GET to a hardcoded Project Discovery Interactsh (oast.fun) subdomain, transmitting the package name, os.platform(), and os.hostname() as query parameters (target: https://dapnhid534ch06s9vpm0mbg1httu5gytc.oast.fun). The behavior is unconditional, undocumented, and fires at module load with no caller opt-in. The name/scope, the author claim of 'Apple, Inc', and the OAST callback destination are the standard dependency-confusion reconnaissance shape: the beacon confirms that an internal build system has resolved the attacker's public package instead of Apple's private one, and leaks the internal hostname of the machine that resolved it.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020491",
            "import_time":  "2026-09-23T14:19:31.869628617Z",
            "modified_time":  "2026-09-23T14:10:47Z",
            "sha256":  "920277566757bdc38563c7e2150e906790478cbd7a0c48f0bb53004e82eec4ca",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / com.apple.unityplugin.storekit

Package

Name
com.apple.unityplugin.storekit
View open source insights on deps.dev
Purl
pkg:npm/com.apple.unityplugin.storekit

Affected ranges

Affected versions

1.*
1.0.2

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "index.js",
            "sha256":  "29dab8bc128d6a5323f474175e9eb6df68ba488480dbbf36c04dc4ef62e91f0b",
            "tlsh":  "55e061f442d34b715f6047c05042244db54795757560e680f78942a45fd3db15931efc"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "com.apple.unityplugin.storekit-1.0.2.tgz",
            "hashes":  {
                "sha1":  "bf63c5ce089c07285eccc7ae69e671bacca7f756",
                "sha512_sri":  "sha512-+eN7chIlxd2xfgpoFJk2eqUFyHIXB5CsmF67Cg6JaYrhfeYkrkG7aUIfAwGxNG1N6BFMk/yfcmo1zQvJIZAvag=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/com.apple.unityplugin.storekit/MAL-2026-16477.json"