MAL-2026-18448

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@mobile-platform/magnetic-components/MAL-2026-18448.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18448
Published
2026-10-29T15:19:02Z
Modified
2026-11-02T05:30:05Z
Summary
Malicious code in @mobile-platform/magnetic-components (npm)
Details

@mobile-platform/magnetic-components is a dependency-confusion package: its description says the scoped name is referenced in the Meraki Dashboard Android app's bundled JavaScript and was unclaimed on the public registry, so a build that resolves @mobile-platform from npm runs its code instead of the intended private package. Its preinstall script runs node preinstall.js on npm install; in 0.0.1 and 0.0.2 it writes DEPENDENCY_CONFUSION_POC_MARKER.txt into the working directory, and in 0.0.3 it makes a DNS lookup of a fixed subdomain of dbhmeq71af5395un3p70tujr84cuwuyg7.oast.me, an interactsh callback host, signalling that the package was installed. It sends no host data beyond the lookup itself, but unreviewed code from an outside publisher has run with the installing user's privileges. The npm account io-8 published the three versions on 2026-10-29.

Database specific 
{
    "iocs":  {
        "domains":  [
            "dbhmeq71af5395un3p70tujr84cuwuyg7.oast.me"
        ],
        "files":  [
            {
                "digests":  {
                    "sha256":  "b05b2de35c5389f706fe6eee9828ac202d7b35515ef9a0a23dbee6f5403e92fb"
                },
                "note":  "preinstall runs `node preinstall.js` (@mobile-platform/magnetic-components@0.0.1).",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "322393c3bedbac6de7e38a571c143fe6a5784d0b882ceb79397d762bdd8a2626"
                },
                "note":  "Executed by the preinstall script of @mobile-platform/magnetic-components@0.0.1.",
                "paths":  [
                    "preinstall.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "ea24f367887b542a1bdd9e3e016e0a5facf4b85be726a028e4b7763c7bee6b03"
                },
                "note":  "preinstall runs `node preinstall.js` (@mobile-platform/magnetic-components@0.0.2).",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "322393c3bedbac6de7e38a571c143fe6a5784d0b882ceb79397d762bdd8a2626"
                },
                "note":  "Executed by the preinstall script of @mobile-platform/magnetic-components@0.0.2.",
                "paths":  [
                    "preinstall.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "2aa36d500c4a7b8551e5e7e6bbbf6b9cfe524712433b637eec4deda8483ebe39"
                },
                "note":  "preinstall runs `node preinstall.js` (@mobile-platform/magnetic-components@0.0.3).",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "a3579427acd74986af891231ebf87f4dd2649b831c11203df0d887dcbb79513c"
                },
                "note":  "Executed by the preinstall script of @mobile-platform/magnetic-components@0.0.3.",
                "paths":  [
                    "preinstall.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            }
        ]
    }
}
References
Credits

Affected packages

npm / @mobile-platform/magnetic-components

Package

Name
@mobile-platform/magnetic-components
View open source insights on deps.dev
Purl
pkg:npm/%40mobile-platform/magnetic-components

Affected ranges

Affected versions

0.*
0.0.1
0.0.2
0.0.3

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@mobile-platform/magnetic-components/MAL-2026-18448.json"