MAL-2026-18294

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@capsense/ccx-welcome-page/MAL-2026-18294.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18294
Aliases
  • GHSA-phgq-4c2g-6xpx
Related
Published
2026-10-25T17:34:58Z
Modified
2026-10-29T14:30:31Z
Summary
Malicious code in @capsense/ccx-welcome-page (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0f63b73ae5e707b0eecee16f97f8ab26b350d135547448fbf6e005ba33303060)

The package publishes under the @capsense scope at version 99.99.100 and wires all three npm lifecycle hooks (preinstall, install, postinstall) to run beacon.js. beacon.js collects os.hostname(), os.userInfo(), and os.platform() and sends the installer's hostname, username, and OS to two hardcoded attacker-controlled collectors: a DNS lookup against the Interactsh OAST subdomain dbf2v9d8dg559apcd93guf6i7uxrn5coo.oast.pro and an HTTPS GET to webhook.site/59675304-bec1-4ca0-8409-8d37b65ec116 with the host identity in the query string. The scope+version combination (public @capsense scope, implausibly high 99.99.100) is the canonical dependency-confusion shape, intended to override a private internal @capsense package during resolution and fire the beacon on any internal build that pulls the public version. The self-label as a 'dependency-confusion PoC' does not change the behavior: any installer whose build resolves this package has their host identity shipped to third-party collectors without consent.

Source: ghsa-malware (ecd5f17a5f3f4128a9a96453aa873b5f447eccc12563702e0e84d8b63b0719b8)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Source: ossf-package-analysis (08a76d2425b34728eb502d47ba660eefd26e944864de58d8022e82c367dd55b2)

The OpenSSF Package Analysis project identified '@capsense/ccx-welcome-page' @ 99.99.100 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.
Database specific 
{
    "iocs": {
        "domains": [
            "dbf2v9d8dg559apcd93guf6i7uxrn5coo.oast.pro"
        ],
        "files": [
            {
                "digests": {
                    "sha256": "8065387f0e043d719a2d2900373657a009fb5ce91018b1fd65713e47ab9a5f95"
                },
                "note": "preinstall, install and postinstall scripts each run `node beacon.js <stage>`, which sends hostname and username to an oast.pro interactsh host and webhook.site (@capsense/ccx-welcome-page@99.99.99).",
                "paths": [
                    "package.json"
                ],
                "source": "PACKAGE_ARCHIVE"
            },
            {
                "digests": {
                    "sha256": "1e2950c3e5f1bc27057224195e55566f4909d75b0de8bee9acf64caa280b6df3"
                },
                "note": "Executed by the preinstall, install and postinstall scripts of @capsense/ccx-welcome-page@99.99.99.",
                "paths": [
                    "beacon.js"
                ],
                "source": "PACKAGE_ARCHIVE"
            }
        ],
        "urls": [
            "https://webhook.site/59675304-bec1-4ca0-8409-8d37b65ec116"
        ]
    },
    "malicious-packages-origins": [
        {
            "import_time": "2026-10-25T18:19:33.499559883Z",
            "modified_time": "2026-10-25T18:19:29Z",
            "sha256": "08a76d2425b34728eb502d47ba660eefd26e944864de58d8022e82c367dd55b2",
            "source": "ossf-package-analysis",
            "versions": [
                "99.99.100"
            ]
        },
        {
            "id": "IN-MAL-2026-021738",
            "import_time": "2026-10-26T06:39:39.191385525Z",
            "modified_time": "2026-10-26T05:59:34Z",
            "sha256": "0c2b35b8f84afc6a83d56e3705c65c7236bc1d0c51974fabdb68c65c8637ea3d",
            "source": "amazon-inspector",
            "versions": [
                "99.99.99"
            ]
        },
        {
            "id": "IN-MAL-2026-021739",
            "import_time": "2026-10-26T06:39:39.283486083Z",
            "modified_time": "2026-10-26T05:59:41Z",
            "sha256": "0f63b73ae5e707b0eecee16f97f8ab26b350d135547448fbf6e005ba33303060",
            "source": "amazon-inspector",
            "versions": [
                "99.99.100"
            ]
        },
        {
            "id": "GHSA-phgq-4c2g-6xpx",
            "import_time": "2026-10-26T16:31:42.743513122Z",
            "modified_time": "2026-10-26T16:20:00Z",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "SEMVER"
                }
            ],
            "sha256": "ecd5f17a5f3f4128a9a96453aa873b5f447eccc12563702e0e84d8b63b0719b8",
            "source": "ghsa-malware"
        },
        {
            "id": "IN-MAL-2026-022292",
            "import_time": "2026-10-29T14:14:40.698246471Z",
            "modified_time": "2026-10-29T14:13:48Z",
            "sha256": "f7983b1fc81a9d163885053a4eb8ab9b0f029f963ee0d5377e6de9c2f8443bb9",
            "source": "amazon-inspector",
            "versions": [
                "0.0.0-stage"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @capsense/ccx-welcome-page

Package

Name
@capsense/ccx-welcome-page
View open source insights on deps.dev
Purl
pkg:npm/%40capsense/ccx-welcome-page

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.0.0-stage
99.*
99.99.99
99.99.100

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "beacon.js",
            "sha256": "1e2950c3e5f1bc27057224195e55566f4909d75b0de8bee9acf64caa280b6df3",
            "tlsh": "7c3155af4638a5245370b1f4c55f412d8af3e278078557d8942cc3519fb983c4253ebc"
        },
        {
            "path": "package.json",
            "sha256": "8065387f0e043d719a2d2900373657a009fb5ce91018b1fd65713e47ab9a5f95",
            "tlsh": "61f0a2245818ab375de202eb1c73196dba718ee693146d08579b4144e34fb9e113b35a"
        }
    ],
    "package_integrity": [
        {
            "filename": "ccx-welcome-page-99.99.99.tgz",
            "hashes": {
                "sha1": "f71b57d4069e4404c741ed6082508ae47c3c7526",
                "sha512_sri": "sha512-ubgsdyNFpjuOkPNWdqZ+N67gpBMQzUpdrqayKxkk3Q0FzSfvqa2Kic+N3AR4RfJkJLs1vDIhoTb93S9igrSO+w=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@capsense/ccx-welcome-page/MAL-2026-18294.json"