{"id":"MAL-2026-18274","summary":"Malicious code in @ppa-web-components/ppa-headerfooter (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (32234bc8ba0c918d154d680b15a1bcb7ae6f6b7d20365c02095842b84e245dce)\nThe package ships a `beacon.cjs` script wired as both the `postinstall` lifecycle hook (`node beacon.cjs`) and a require-time side effect from `index.js`. On install and on `require()`, the beacon POSTs installer identifiers — `os.hostname()`, the install path (`__dirname`), `process.cwd()`, `process.version`, and the package name — to the hardcoded bare-IP plaintext HTTP endpoint `http://185.158.107.175:8787/_ah/dc`. The package otherwise provides no functionality: `index.js` exports a Proxy that returns a no-op function for every property access, so the beacon is the sole purpose of the package. The combination of a scoped name resembling a web-components namespace, a 'Compatibility shim' description, a functionless Proxy stub, and a bare-IP recon beacon is the shape of a dependency-confusion / typosquat probe measuring where the package resolves inside private build environments, typically preceding a targeted follow-up payload.\n","modified":"2026-10-25T14:45:04.665135696Z","published":"2026-10-25T14:37:25Z","database_specific":{"malicious-packages-origins":[{"sha256":"32234bc8ba0c918d154d680b15a1bcb7ae6f6b7d20365c02095842b84e245dce","source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-021647","import_time":"2026-10-25T14:39:51.59404739Z","modified_time":"2026-10-25T14:37:48Z"},{"sha256":"9e7bd7ef6876f524713cbb7f67f93a04096f1184296e033f38c02ad4644b363d","source":"amazon-inspector","versions":["2.0.1"],"id":"IN-MAL-2026-021649","import_time":"2026-10-25T14:39:51.651410314Z","modified_time":"2026-10-25T14:38:03Z"},{"source":"amazon-inspector","versions":["1.1.0"],"id":"IN-MAL-2026-021644","import_time":"2026-10-25T14:39:51.501599532Z","modified_time":"2026-10-25T14:37:25Z","sha256":"a9b42b08ad4bc0eff74e33aaa1ef0dc69af53c215655790c89957f04d5469557"},{"modified_time":"2026-10-25T14:37:34Z","sha256":"3b94cf7469c54847b45c215abeb823c5af606e01f2518d3288bf25dc69504e97","source":"amazon-inspector","versions":["99.0.1"],"id":"IN-MAL-2026-021645","import_time":"2026-10-25T14:39:51.536740834Z"},{"versions":["2.0.0"],"id":"IN-MAL-2026-021646","import_time":"2026-10-25T14:39:51.565278925Z","modified_time":"2026-10-25T14:37:41Z","sha256":"3f8383e1c9b3c497ee3b225ad4d5b27f02d9a5f75470921cd9e25f13221dfab8","source":"amazon-inspector"},{"id":"IN-MAL-2026-021648","import_time":"2026-10-25T14:39:51.621557724Z","modified_time":"2026-10-25T14:37:56Z","sha256":"4c37eba03dca2da218b616b3ca2091fdc9f2aa3e18a85a298e10c3dff712b46d","source":"amazon-inspector","versions":["3.0.0"]},{"sha256":"8a556618b8d34db0a7655bc99411ba764fee437890ea374ad2f05fd96657db45","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-021654","import_time":"2026-10-25T14:39:51.800208916Z","modified_time":"2026-10-25T14:38:38Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ppa-web-components/ppa-headerfooter/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ppa-web-components/ppa-headerfooter/v/2.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ppa-web-components/ppa-headerfooter/v/1.1.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ppa-web-components/ppa-headerfooter/v/99.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ppa-web-components/ppa-headerfooter/v/2.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ppa-web-components/ppa-headerfooter/v/3.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ppa-web-components/ppa-headerfooter/v/1.0.0"}],"affected":[{"package":{"name":"@ppa-web-components/ppa-headerfooter","ecosystem":"npm","purl":"pkg:npm/%40ppa-web-components/ppa-headerfooter"},"versions":["1.0.1","2.0.1","1.1.0","99.0.1","2.0.0","3.0.0","1.0.0"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"path":"beacon.cjs","sha256":"4d0bf7f88f3118313d3cbb424690615ad89f56565bd55bab883bb2bb33b2826f","tlsh":"a83161eba8e0a0089aa67098d54f1409f27bf0069501ab54fd5c82959f7257c33fa8dc"},{"tlsh":"2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee","path":"index.js","sha256":"a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d"}],"package_integrity":[{"filename":"ppa-headerfooter-1.0.1.tgz","hashes":{"sha512_sri":"sha512-3h0XWkSFT8l/ntSxFhegxFu037nNGb729nHG6zEDlRtD322ch/ETFpkrQCTpMtTbKfNgXRS4+VQcZZrka/4gjA==","sha1":"40195217b72ecde0b78ce50eb77fed04f2b597d1"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ppa-web-components/ppa-headerfooter/MAL-2026-18274.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}