MAL-2026-18286

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ppa-web-components/ppa-navigation/MAL-2026-18286.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18286
Published
2026-10-25T14:41:36Z
Modified
2026-10-25T15:30:06Z
Summary
Malicious code in @ppa-web-components/ppa-navigation (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c88c344e72bb7cf5ae6f5e6185a1024caf8b96bce96584d448609ab78cd894af)

The package is a shim whose only functional payload is a beacon. package.json declares a postinstall that runs node beacon.cjs, and index.js additionally invokes require('./beacon.cjs').fire() on load, so the beacon fires both at npm install and whenever any consumer requires the package. The beacon POSTs the installer's hostname, install path, current working directory, and Node version to the hardcoded bare-IP plain-HTTP endpoint http://185.158.107.175:8787/_ah/dc. The destination is not a registry, not a documented first-party service, and the plain-IP + non-standard port shape is inconsistent with any legitimate vendor telemetry. The package otherwise exports a Proxy that returns no-op functions for every property and self-describes as a 'Compatibility shim', so the beacon is the entire payload. The scoped name @ppa-web-components/ppa-navigation has the shape of a dependency-confusion or typosquat probe against an internal @ppa-web-components namespace.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-021683",
            "import_time":  "2026-10-25T15:15:13.409241479Z",
            "modified_time":  "2026-10-25T14:42:16Z",
            "sha256":  "026702de077c4a1c2484a231e23f3f27c3f761a86f533cfd147d0de5c2b1a283",
            "source":  "amazon-inspector",
            "versions":  [
                "2.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-021678",
            "import_time":  "2026-10-25T15:15:12.880692065Z",
            "modified_time":  "2026-10-25T14:41:45Z",
            "sha256":  "1538a336b4c8cc56db09f121a607037208aaa33faf91d881451e13ce48a452d8",
            "source":  "amazon-inspector",
            "versions":  [
                "2.0.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-021680",
            "import_time":  "2026-10-25T15:15:13.109992136Z",
            "modified_time":  "2026-10-25T14:41:58Z",
            "sha256":  "7edf7e8b60b92cb31386220646a8b378a2e5271251b2ba0b453909cd52c0bf49",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-021681",
            "import_time":  "2026-10-25T15:15:13.193639715Z",
            "modified_time":  "2026-10-25T14:42:04Z",
            "sha256":  "b87fdccec8a51dfac449f4332ffde4f4131a208f343d2ab12ddcad09f247eae1",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-021677",
            "import_time":  "2026-10-25T15:15:12.76719655Z",
            "modified_time":  "2026-10-25T14:41:36Z",
            "sha256":  "c88c344e72bb7cf5ae6f5e6185a1024caf8b96bce96584d448609ab78cd894af",
            "source":  "amazon-inspector",
            "versions":  [
                "3.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-021682",
            "import_time":  "2026-10-25T15:15:13.300613279Z",
            "modified_time":  "2026-10-25T14:42:10Z",
            "sha256":  "e4d4d433ecfb4d5b1e5199598eee93e503b4fafc143d24e390b2522161c4db28",
            "source":  "amazon-inspector",
            "versions":  [
                "99.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @ppa-web-components/ppa-navigation

Package

Name
@ppa-web-components/ppa-navigation
View open source insights on deps.dev
Purl
pkg:npm/%40ppa-web-components/ppa-navigation

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
2.*
2.0.0
2.0.1
3.*
3.0.0
99.*
99.0.1

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "beacon.cjs",
            "sha256":  "dd92d44238fbae6a537f6870a0c6c15bd09d5ef5bfe9feafdc6b296b8911504b",
            "tlsh":  "563161efa8f0a008aaa77098c54f1409b27bf0079501ab50fd5d83959f6297c33fa8dc"
        },
        {
            "path":  "index.js",
            "sha256":  "a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d",
            "tlsh":  "2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "ppa-navigation-2.0.0.tgz",
            "hashes":  {
                "sha1":  "a72cdea28cb03999385c093e5bca55f8760da38b",
                "sha512_sri":  "sha512-IjB3YiNBCJChexEB0YG3sWjmJRl3UGDWXr+gMreOZt/d+PBuFoqE3qAhuIGsLubS1Hl1E7ildDXN/ZlBOz9PbA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ppa-web-components/ppa-navigation/MAL-2026-18286.json"