MAL-2026-18373

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zmtcdn/ui/MAL-2026-18373.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18373
Published
2026-10-28T07:27:15Z
Modified
2026-10-29T09:15:04Z
Summary
Malicious code in @zmtcdn/ui (npm)
Details

@zmtcdn/ui 9999.0.0 and 9999.0.7 are dependency-confusion packages with an empty index.js and a description of "Security research PoC". Their postinstall script runs node postinstall.js on npm install, which POSTs the hostname, username, platform, working directory and the names of all environment variables to https://www.hinny.shop/api. They were published by the npm account kill_shs, which also published @zmtcdn/components with the same script.

Database specific 
{
    "iocs":  {
        "domains":  [
            "hinny.shop"
        ],
        "files":  [
            {
                "digests":  {
                    "sha256":  "89d6f6810a40838b4a82e4f8be92f9f22541707ecef8e856ebf522ab0a3b9053"
                },
                "note":  "postinstall runs `node postinstall.js`, which POSTs host details to a collector (@zmtcdn/ui@9999.0.0).",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "8bbd4c1f109d109d0953fb78d35c0483207a049d0220e3470d22b6d2403d1be6"
                },
                "note":  "Executed by the postinstall script of @zmtcdn/ui@9999.0.0.",
                "paths":  [
                    "postinstall.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "f1b913f1a0e6d98c104fd8c37fc9569e72a25ee521c9be1a3745cac57c699693"
                },
                "note":  "postinstall runs `node postinstall.js`, which POSTs host details to a collector (@zmtcdn/ui@9999.0.7).",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "8bbd4c1f109d109d0953fb78d35c0483207a049d0220e3470d22b6d2403d1be6"
                },
                "note":  "Executed by the postinstall script of @zmtcdn/ui@9999.0.7.",
                "paths":  [
                    "postinstall.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            }
        ],
        "urls":  [
            "https://www.hinny.shop/api"
        ]
    }
}
References
Credits

Affected packages

npm / @zmtcdn/ui

Package

Name
@zmtcdn/ui
View open source insights on deps.dev
Purl
pkg:npm/%40zmtcdn/ui

Affected ranges

Affected versions

9999.*
9999.0.0
9999.0.7

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zmtcdn/ui/MAL-2026-18373.json"