MAL-2026-18274

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ppa-web-components/ppa-headerfooter/MAL-2026-18274.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18274
Published
2026-10-25T14:37:25Z
Modified
2026-10-25T14:45:04Z
Summary
Malicious code in @ppa-web-components/ppa-headerfooter (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (32234bc8ba0c918d154d680b15a1bcb7ae6f6b7d20365c02095842b84e245dce)

The package ships a beacon.cjs script wired as both the postinstall lifecycle hook (node beacon.cjs) and a require-time side effect from index.js. On install and on require(), the beacon POSTs installer identifiers — os.hostname(), the install path (__dirname), process.cwd(), process.version, and the package name — to the hardcoded bare-IP plaintext HTTP endpoint http://185.158.107.175:8787/_ah/dc. The package otherwise provides no functionality: index.js exports a Proxy that returns a no-op function for every property access, so the beacon is the sole purpose of the package. The combination of a scoped name resembling a web-components namespace, a 'Compatibility shim' description, a functionless Proxy stub, and a bare-IP recon beacon is the shape of a dependency-confusion / typosquat probe measuring where the package resolves inside private build environments, typically preceding a targeted follow-up payload.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-021647",
            "import_time":  "2026-10-25T14:39:51.59404739Z",
            "modified_time":  "2026-10-25T14:37:48Z",
            "sha256":  "32234bc8ba0c918d154d680b15a1bcb7ae6f6b7d20365c02095842b84e245dce",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-021649",
            "import_time":  "2026-10-25T14:39:51.651410314Z",
            "modified_time":  "2026-10-25T14:38:03Z",
            "sha256":  "9e7bd7ef6876f524713cbb7f67f93a04096f1184296e033f38c02ad4644b363d",
            "source":  "amazon-inspector",
            "versions":  [
                "2.0.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-021644",
            "import_time":  "2026-10-25T14:39:51.501599532Z",
            "modified_time":  "2026-10-25T14:37:25Z",
            "sha256":  "a9b42b08ad4bc0eff74e33aaa1ef0dc69af53c215655790c89957f04d5469557",
            "source":  "amazon-inspector",
            "versions":  [
                "1.1.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-021645",
            "import_time":  "2026-10-25T14:39:51.536740834Z",
            "modified_time":  "2026-10-25T14:37:34Z",
            "sha256":  "3b94cf7469c54847b45c215abeb823c5af606e01f2518d3288bf25dc69504e97",
            "source":  "amazon-inspector",
            "versions":  [
                "99.0.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-021646",
            "import_time":  "2026-10-25T14:39:51.565278925Z",
            "modified_time":  "2026-10-25T14:37:41Z",
            "sha256":  "3f8383e1c9b3c497ee3b225ad4d5b27f02d9a5f75470921cd9e25f13221dfab8",
            "source":  "amazon-inspector",
            "versions":  [
                "2.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-021648",
            "import_time":  "2026-10-25T14:39:51.621557724Z",
            "modified_time":  "2026-10-25T14:37:56Z",
            "sha256":  "4c37eba03dca2da218b616b3ca2091fdc9f2aa3e18a85a298e10c3dff712b46d",
            "source":  "amazon-inspector",
            "versions":  [
                "3.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-021654",
            "import_time":  "2026-10-25T14:39:51.800208916Z",
            "modified_time":  "2026-10-25T14:38:38Z",
            "sha256":  "8a556618b8d34db0a7655bc99411ba764fee437890ea374ad2f05fd96657db45",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @ppa-web-components/ppa-headerfooter

Package

Name
@ppa-web-components/ppa-headerfooter
View open source insights on deps.dev
Purl
pkg:npm/%40ppa-web-components/ppa-headerfooter

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
1.1.0
2.*
2.0.0
2.0.1
3.*
3.0.0
99.*
99.0.1

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "beacon.cjs",
            "sha256":  "4d0bf7f88f3118313d3cbb424690615ad89f56565bd55bab883bb2bb33b2826f",
            "tlsh":  "a83161eba8e0a0089aa67098d54f1409f27bf0069501ab54fd5c82959f7257c33fa8dc"
        },
        {
            "path":  "index.js",
            "sha256":  "a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d",
            "tlsh":  "2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "ppa-headerfooter-1.0.1.tgz",
            "hashes":  {
                "sha1":  "40195217b72ecde0b78ce50eb77fed04f2b597d1",
                "sha512_sri":  "sha512-3h0XWkSFT8l/ntSxFhegxFu037nNGb729nHG6zEDlRtD322ch/ETFpkrQCTpMtTbKfNgXRS4+VQcZZrka/4gjA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ppa-web-components/ppa-headerfooter/MAL-2026-18274.json"