MAL-2026-17806

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ap3-foundations-ui/MAL-2026-17806.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17806
Published
2026-10-12T00:57:37Z
Modified
2026-10-13T06:45:04Z
Summary
Malicious code in ap3-foundations-ui (npm)
Details

ap3-foundations-ui describes itself as a security research PoC for dependency confusion and does not identify an upstream package it copies. Its preinstall hook runs node index.js during npm install; the script sends the package name and version, hostname, username, home directory, working directory, platform, architecture, and CI flag to https://webhook.site/7dbd5e4e-3156-427f-b383-30c14d845587. The npm account vikkuthetester22 published it on 2026-10-12.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7469eefaab624821647b4e412c4ceac1f422d4857b8484767041fdc355398477)

The package's preinstall hook runs index.js, which collects installer host identifiers (os.hostname(), os.userInfo().username, os.homedir(), process.cwd(), os.platform(), os.arch(), and process.env.CI) and POSTs them as JSON to a hardcoded third-party collector at https://webhook.site/7dbd5e4e-3156-427f-b383-30c14d845587. The behavior fires automatically on npm install without caller consent. The package is published at version 99.0.1 under a name consistent with an internal/private namespace, matching the shape of a dependency-confusion beacon used to confirm successful name hijack in a target environment. The exfiltrated fields identify the installing host, user account, working directory, and CI status — information useful for targeting follow-on attacks against the organization whose build pulled the package.

Database specific 
{
    "iocs":  {
        "files":  [
            {
                "digests":  {
                    "sha256":  "44180ea5d9e3df9978bc4c5a0be8635656f7ca8b73e9ddd9e1d384d673e53604"
                },
                "note":  "preinstall script: node index.js",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "289c3b12fdd5798f6c38b731035ab96abc736f80a0c226d279fd96ebfbe2075a"
                },
                "note":  "Executed by the preinstall script of ap3-foundations-ui@99.0.1.",
                "paths":  [
                    "index.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            }
        ],
        "urls":  [
            "https://webhook.site/7dbd5e4e-3156-427f-b383-30c14d845587"
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-021459",
            "import_time":  "2026-10-12T04:58:42.447698328Z",
            "modified_time":  "2026-10-12T04:56:13Z",
            "sha256":  "7469eefaab624821647b4e412c4ceac1f422d4857b8484767041fdc355398477",
            "source":  "amazon-inspector",
            "versions":  [
                "99.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / ap3-foundations-ui

Package

Name
ap3-foundations-ui
View open source insights on deps.dev
Purl
pkg:npm/ap3-foundations-ui

Affected ranges

Affected versions

99.*
99.0.1

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "index.js",
            "sha256":  "289c3b12fdd5798f6c38b731035ab96abc736f80a0c226d279fd96ebfbe2075a",
            "tlsh":  "9f1140e016b16b300ff69bc13885dd0512b6e522b10f7de0bb8912e4578e6f900729f9"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "ap3-foundations-ui-99.0.1.tgz",
            "hashes":  {
                "sha1":  "7d9d180ba806adbf9ad68bf58e8e14296f096ec3",
                "sha512_sri":  "sha512-66vCx1gasRYVhVMz5QOAWWJq/ff7sSK+LkQx0mAJhbc+pt9RjkAsHiXNXUpVjIDA003Yy3SHkYN8akmlLis7EQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ap3-foundations-ui/MAL-2026-17806.json"