MAL-2026-18287

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ppa-web-components/ppa-searchform/MAL-2026-18287.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-18287

Published

2026-10-25T14:40:34Z

Modified

2026-10-25T15:30:06Z

Summary

Malicious code in @ppa-web-components/ppa-searchform (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c9b929e77e53b5f528d874024d0cf8cfe4a0e34845796964600b0e1511e6a49c)

The package ships a beacon.cjs that is wired to run both via the postinstall lifecycle script and from top-level index.js on require(). On execution it collects host identifiers (hostname, install path, current working directory, Node.js version) and POSTs them to a hardcoded bare-IPv4 endpoint over plaintext HTTP at http://185.158.107.175:8787/_ah/dc. The destination is not a publisher-owned domain. The package's index.js exports a Proxy that returns no-op functions for every property access, so the module provides no real functionality — its only effect on install or import is the beacon callback. The combination of a non-functional shim under an organisation-shaped scope with a reconnaissance beacon fired at install and import time is the fingerprint of a dependency-confusion / namesquat probe that reports successful resolution and build inside a victim's environment.

Database specific

{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-021671",
            "import_time":  "2026-10-25T15:15:12.140088669Z",
            "modified_time":  "2026-10-25T14:40:48Z",
            "sha256":  "06065b974e1025f447c2880c0b2e3b746ae706ca19aed737af56bf00a52a8d04",
            "source":  "amazon-inspector",
            "versions":  [
                "0.0.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-021670",
            "import_time":  "2026-10-25T15:15:12.014489114Z",
            "modified_time":  "2026-10-25T14:40:42Z",
            "sha256":  "6748411f06b397e32c53e7be874186ad7742b6aeab92813685e00e2f243df56e",
            "source":  "amazon-inspector",
            "versions":  [
                "2.0.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-021675",
            "import_time":  "2026-10-25T15:15:12.57283105Z",
            "modified_time":  "2026-10-25T14:41:17Z",
            "sha256":  "a30ec0bc7e5ce23161923c64771ac09af354713275b6901394d486f9dac8b1db",
            "source":  "amazon-inspector",
            "versions":  [
                "3.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-021674",
            "import_time":  "2026-10-25T15:15:12.467755671Z",
            "modified_time":  "2026-10-25T14:41:09Z",
            "sha256":  "ae158cc433dc18d2e0573be61e833ea018f020e8341774cc4ca051bf98d2ce32",
            "source":  "amazon-inspector",
            "versions":  [
                "99.0.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-021672",
            "import_time":  "2026-10-25T15:15:12.237958917Z",
            "modified_time":  "2026-10-25T14:40:54Z",
            "sha256":  "c9b929e77e53b5f528d874024d0cf8cfe4a0e34845796964600b0e1511e6a49c",
            "source":  "amazon-inspector",
            "versions":  [
                "2.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-021676",
            "import_time":  "2026-10-25T15:15:12.676821181Z",
            "modified_time":  "2026-10-25T14:41:30Z",
            "sha256":  "cb780f2b1bbd30330912f5d3d113a3485769aa28788f4b31fb5de45f55ce3de9",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-021669",
            "import_time":  "2026-10-25T15:15:11.876574537Z",
            "modified_time":  "2026-10-25T14:40:34Z",
            "sha256":  "3c7ec1dc7dadbe1ead7bd25f527ccefa573c551b7a090b44dbcf00c3e25d1f0c",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-021673",
            "import_time":  "2026-10-25T15:15:12.349740309Z",
            "modified_time":  "2026-10-25T14:41:00Z",
            "sha256":  "6131142f8331a79d71661068d7befb1fe73b56d2347b9b3cc52aea58c4b1c9e7",
            "source":  "amazon-inspector",
            "versions":  [
                "1.1.0"
            ]
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / @ppa-web-components/ppa-searchform

Package

Name: @ppa-web-components/ppa-searchform; View open source insights on deps.dev
Purl: pkg:npm/%40ppa-web-components/ppa-searchform

Affected ranges

Affected versions

0.*

0.0.1

1.*

1.0.0

1.0.1

1.1.0

2.*

2.0.0

2.0.1

3.*

3.0.0

99.*

99.0.1

Database specific

cwes

[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]

indicators

{
    "evidence_files":  [
        {
            "path":  "beacon.cjs",
            "sha256":  "5d51dc45fdda26f147c663da85e0e1c6ef487e5ff827a155e15659b29289465f",
            "tlsh":  "dc3161eba8f0a0089aaa7098c54f1409b27bf0069501af50fd5c82919f7297c33fa8dc"
        },
        {
            "path":  "index.js",
            "sha256":  "a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d",
            "tlsh":  "2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "ppa-searchform-0.0.1.tgz",
            "hashes":  {
                "sha1":  "6d54e03bae1d9ac657d6f0545462fd33c3d122a7",
                "sha512_sri":  "sha512-wKiqX/AX5gfk2XJSfEDlca9ZS+F+CddA2fWrqKRo0pUHhe1Ii8BZaPxkhm6i7h9XPPUQWTBNES3l886EtiqjcA=="
            }
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ppa-web-components/ppa-searchform/MAL-2026-18287.json"