MAL-2026-18272

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ppa-web-components/ppa-banner/MAL-2026-18272.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18272
Published
2026-10-25T14:38:55Z
Modified
2026-10-25T15:30:06Z
Summary
Malicious code in @ppa-web-components/ppa-banner (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (bcf0b03540a27943a2afcc26927ce7256d85328bc4fcbc2562f36a88ad75ce8d)

@ppa-web-components/ppa-banner@1.0.1 is described as a 'Compatibility shim' but ships only two code paths: a no-op Proxy as its main export, and beacon.cjs. beacon.cjs defines BEACON = "http://185.158.107.175:8787/_ah/dc" and a fire() function that POSTs a JSON payload containing the package name, os.hostname(), the install path (__dirname), process.cwd(), and the Node/npm version to that bare-IP, plain-HTTP endpoint. fire() is invoked both from the postinstall lifecycle hook (node beacon.cjs) and from the module's main entry, so the beacon fires automatically on npm install and again whenever the package is required. The destination is an unrelated bare IP over cleartext HTTP, not any publisher-controlled or registry infrastructure, and the shipped stub has no functional purpose other than the beacon. The scoped-name + stub + install-time recon beacon shape is consistent with a dependency-confusion recon callback used to identify internal build environments that resolved this public name.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-021660",
            "import_time":  "2026-10-25T14:39:51.980939383Z",
            "modified_time":  "2026-10-25T14:39:25Z",
            "sha256":  "35af6d526fad6fe2130efc48464463d470569db47c828a2b422b9c95b2111695",
            "source":  "amazon-inspector",
            "versions":  [
                "2.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-021659",
            "import_time":  "2026-10-25T14:39:51.945646788Z",
            "modified_time":  "2026-10-25T14:39:16Z",
            "sha256":  "36b79c97270972d28415a17b5dbd1fb0da4081030647e73ee347840d3cdc3fee",
            "source":  "amazon-inspector",
            "versions":  [
                "2.0.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-021657",
            "import_time":  "2026-10-25T14:39:51.888604231Z",
            "modified_time":  "2026-10-25T14:39:03Z",
            "sha256":  "447fb9075e65dd4f03f423030cd84607cd16f572dc0319ff41ab3d804e0b57be",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-021656",
            "import_time":  "2026-10-25T14:39:51.85863203Z",
            "modified_time":  "2026-10-25T14:38:55Z",
            "sha256":  "bcf0b03540a27943a2afcc26927ce7256d85328bc4fcbc2562f36a88ad75ce8d",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-021661",
            "import_time":  "2026-10-25T14:39:52.006988642Z",
            "modified_time":  "2026-10-25T14:39:31Z",
            "sha256":  "c0a152ff87a60ea07f4e0a3521a16c3f0f64d633ecda3a833156ab7cfe9ad22e",
            "source":  "amazon-inspector",
            "versions":  [
                "0.0.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-021658",
            "import_time":  "2026-10-25T14:39:51.915922929Z",
            "modified_time":  "2026-10-25T14:39:09Z",
            "sha256":  "d17970f57eb74e19373f85b5ac4d037f43286923f907b038baeb4ad0a6887bf9",
            "source":  "amazon-inspector",
            "versions":  [
                "1.1.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-021663",
            "import_time":  "2026-10-25T15:15:11.253548514Z",
            "modified_time":  "2026-10-25T14:39:47Z",
            "sha256":  "cb2001c98aaf00c14d18eb7d10dd997e3003935a8ff738d52b8414c0e0a1b1a0",
            "source":  "amazon-inspector",
            "versions":  [
                "3.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @ppa-web-components/ppa-banner

Package

Name
@ppa-web-components/ppa-banner
View open source insights on deps.dev
Purl
pkg:npm/%40ppa-web-components/ppa-banner

Affected ranges

Affected versions

0.*
0.0.1
1.*
1.0.0
1.0.1
1.1.0
2.*
2.0.0
2.0.1
3.*
3.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "beacon.cjs",
            "sha256":  "db68021e03c8b586c3376ceb036d22c903a94fa6173d1fb132e1fad6bff0eaf3",
            "tlsh":  "a93161eba8e0a0089aaa7098c54f1409b27bf0079501af50fd5c82919f7257c33fa8dc"
        },
        {
            "path":  "index.js",
            "sha256":  "a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d",
            "tlsh":  "2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "ppa-banner-2.0.0.tgz",
            "hashes":  {
                "sha1":  "7cde411a5db9681bb1b6eea704ba8a4f0577ed72",
                "sha512_sri":  "sha512-Po+/5iV/GjsJNoy/zgmhfWgvLsW2+bbo50cyg9tR3ohFvm0Ze54u+VVOmAo7JnlrXLmqWb/WXULWEq3DkRPskg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ppa-web-components/ppa-banner/MAL-2026-18272.json"