{"id":"MAL-2026-11427","summary":"Malicious code in pp-react-worldready (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6cd3313519c0ef5edb290227d7d183c3d5344473351bc10bcf6a5d09e51c32a7)\npackage.json declares a preinstall hook that runs vishu.js on npm install. The script resolves the installer's public IP via api.ipify.org, reads os.hostname() and CI/GitHub Actions environment variables (CI, GITHUB_ACTIONS, GITHUB_WORKFLOW, GITHUB_RUN_ID), and sends them as query parameters to a hardcoded webhook.site collector at https://webhook.site/1b840cbf-f1a4-4d79-bf11-f1ef62949110. It also performs a DNS lookup embedding the hostname as a subdomain of your-collab-domain.oastify.com (Burp Collaborator) as an out-of-band exfiltration channel. This is the canonical dependency-confusion reconnaissance beacon shape: identify internal build hosts that mistakenly resolve the package name from the public registry.\n\n## Source: ossf-package-analysis (6a0cb104ba7e29ae2e20cb4d191f5a1cb0a74de3a26cc06e9e6369d5bbee94e5)\nThe OpenSSF Package Analysis project identified 'pp-react-worldready' @ 1.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","modified":"2026-08-04T22:05:13.101040363Z","published":"2026-08-01T13:40:50Z","database_specific":{"malicious-packages-origins":[{"versions":["1.0.0"],"import_time":"2026-08-01T14:36:09.526427578Z","modified_time":"2026-08-01T13:40:50Z","sha256":"6a0cb104ba7e29ae2e20cb4d191f5a1cb0a74de3a26cc06e9e6369d5bbee94e5","source":"ossf-package-analysis"},{"import_time":"2026-08-04T21:33:16.646898555Z","modified_time":"2026-08-04T21:32:02Z","sha256":"6cd3313519c0ef5edb290227d7d183c3d5344473351bc10bcf6a5d09e51c32a7","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-011097"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/pp-react-worldready/v/1.0.0"}],"affected":[{"package":{"name":"pp-react-worldready","ecosystem":"npm","purl":"pkg:npm/pp-react-worldready"},"versions":["1.0.0"],"database_specific":{"indicators":{"package_integrity":[{"hashes":{"sha1":"f20d7532e1d0c5ca8b24f73f14caf95ca376bdc3","sha512_sri":"sha512-D/7r5IGpmp3gfzAaAwFI084z10NSrN76lnsK9vFj7ywR//viiHoaA+Ni2WMpJuPPQuJtJzO+YLnpHou44KjJeg=="},"filename":"pp-react-worldready-1.0.0.tgz"}],"evidence_files":[{"tlsh":"bd313e4ca2f7962004f263c8162b941e605be1933729ce917a9c02521faad3882e3bd8","path":"vishu.js","sha256":"2ce5acaf6ac8cd77b4bc4a8329d6f39831cc2e2ed739a0bd1a9284789ba7aa1f"}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/pp-react-worldready/MAL-2026-11427.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}