MAL-2026-18372

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zmtcdn/components/MAL-2026-18372.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18372
Published
2026-10-28T09:59:37Z
Modified
2026-10-29T09:15:04Z
Summary
Malicious code in @zmtcdn/components (npm)
Details

@zmtcdn/components@9999.0.0 is a dependency-confusion package with an empty index.js and a description of "Security research PoC". Its postinstall script runs node postinstall.js on npm install, which POSTs the hostname, username, platform, working directory and the names of all environment variables to https://webhook.site/f52af355-4783-4acb-9de1-5e44b5963025. It was published by the npm account kill_shs, which also published @zmtcdn/ui with the same script.

Database specific 
{
    "iocs":  {
        "files":  [
            {
                "digests":  {
                    "sha256":  "83ecde574a04b04277a0db8cc868bab08f2222f20183de92a6242433340c08ea"
                },
                "note":  "postinstall runs `node postinstall.js`, which POSTs host details to a collector (@zmtcdn/components@9999.0.0).",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "fe334f5ef07787eb80c479592ce2834c0644731f14d74422b6a8ee68d94f1bf0"
                },
                "note":  "Executed by the postinstall script of @zmtcdn/components@9999.0.0.",
                "paths":  [
                    "postinstall.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            }
        ],
        "urls":  [
            "https://webhook.site/f52af355-4783-4acb-9de1-5e44b5963025"
        ]
    }
}
References
Credits

Affected packages

npm / @zmtcdn/components

Package

Name
@zmtcdn/components
View open source insights on deps.dev
Purl
pkg:npm/%40zmtcdn/components

Affected ranges

Affected versions

9999.*
9999.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zmtcdn/components/MAL-2026-18372.json"