{"id":"MAL-2026-18287","summary":"Malicious code in @ppa-web-components/ppa-searchform (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c9b929e77e53b5f528d874024d0cf8cfe4a0e34845796964600b0e1511e6a49c)\nThe package ships a `beacon.cjs` that is wired to run both via the `postinstall` lifecycle script and from top-level `index.js` on `require()`. On execution it collects host identifiers (hostname, install path, current working directory, Node.js version) and POSTs them to a hardcoded bare-IPv4 endpoint over plaintext HTTP at http://185.158.107.175:8787/_ah/dc. The destination is not a publisher-owned domain. The package's `index.js` exports a `Proxy` that returns no-op functions for every property access, so the module provides no real functionality — its only effect on install or import is the beacon callback. The combination of a non-functional shim under an organisation-shaped scope with a reconnaissance beacon fired at install and import time is the fingerprint of a dependency-confusion / namesquat probe that reports successful resolution and build inside a victim's environment.\n","modified":"2026-10-25T15:30:06.405816042Z","published":"2026-10-25T14:40:34Z","database_specific":{"malicious-packages-origins":[{"sha256":"06065b974e1025f447c2880c0b2e3b746ae706ca19aed737af56bf00a52a8d04","source":"amazon-inspector","versions":["0.0.1"],"id":"IN-MAL-2026-021671","import_time":"2026-10-25T15:15:12.140088669Z","modified_time":"2026-10-25T14:40:48Z"},{"modified_time":"2026-10-25T14:40:42Z","sha256":"6748411f06b397e32c53e7be874186ad7742b6aeab92813685e00e2f243df56e","source":"amazon-inspector","versions":["2.0.1"],"id":"IN-MAL-2026-021670","import_time":"2026-10-25T15:15:12.014489114Z"},{"source":"amazon-inspector","versions":["3.0.0"],"id":"IN-MAL-2026-021675","import_time":"2026-10-25T15:15:12.57283105Z","modified_time":"2026-10-25T14:41:17Z","sha256":"a30ec0bc7e5ce23161923c64771ac09af354713275b6901394d486f9dac8b1db"},{"versions":["99.0.1"],"id":"IN-MAL-2026-021674","import_time":"2026-10-25T15:15:12.467755671Z","modified_time":"2026-10-25T14:41:09Z","sha256":"ae158cc433dc18d2e0573be61e833ea018f020e8341774cc4ca051bf98d2ce32","source":"amazon-inspector"},{"import_time":"2026-10-25T15:15:12.237958917Z","modified_time":"2026-10-25T14:40:54Z","sha256":"c9b929e77e53b5f528d874024d0cf8cfe4a0e34845796964600b0e1511e6a49c","source":"amazon-inspector","versions":["2.0.0"],"id":"IN-MAL-2026-021672"},{"versions":["1.0.1"],"id":"IN-MAL-2026-021676","import_time":"2026-10-25T15:15:12.676821181Z","modified_time":"2026-10-25T14:41:30Z","sha256":"cb780f2b1bbd30330912f5d3d113a3485769aa28788f4b31fb5de45f55ce3de9","source":"amazon-inspector"},{"source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-021669","import_time":"2026-10-25T15:15:11.876574537Z","modified_time":"2026-10-25T14:40:34Z","sha256":"3c7ec1dc7dadbe1ead7bd25f527ccefa573c551b7a090b44dbcf00c3e25d1f0c"},{"sha256":"6131142f8331a79d71661068d7befb1fe73b56d2347b9b3cc52aea58c4b1c9e7","source":"amazon-inspector","versions":["1.1.0"],"id":"IN-MAL-2026-021673","import_time":"2026-10-25T15:15:12.349740309Z","modified_time":"2026-10-25T14:41:00Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ppa-web-components/ppa-searchform/v/0.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ppa-web-components/ppa-searchform/v/2.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ppa-web-components/ppa-searchform/v/3.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ppa-web-components/ppa-searchform/v/99.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ppa-web-components/ppa-searchform/v/2.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ppa-web-components/ppa-searchform/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ppa-web-components/ppa-searchform/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ppa-web-components/ppa-searchform/v/1.1.0"}],"affected":[{"package":{"name":"@ppa-web-components/ppa-searchform","ecosystem":"npm","purl":"pkg:npm/%40ppa-web-components/ppa-searchform"},"versions":["0.0.1","2.0.1","3.0.0","99.0.1","2.0.0","1.0.1","1.0.0","1.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-wKiqX/AX5gfk2XJSfEDlca9ZS+F+CddA2fWrqKRo0pUHhe1Ii8BZaPxkhm6i7h9XPPUQWTBNES3l886EtiqjcA==","sha1":"6d54e03bae1d9ac657d6f0545462fd33c3d122a7"},"filename":"ppa-searchform-0.0.1.tgz"}],"evidence_files":[{"tlsh":"dc3161eba8f0a0089aaa7098c54f1409b27bf0069501af50fd5c82919f7297c33fa8dc","path":"beacon.cjs","sha256":"5d51dc45fdda26f147c663da85e0e1c6ef487e5ff827a155e15659b29289465f"},{"path":"index.js","sha256":"a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d","tlsh":"2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ppa-web-components/ppa-searchform/MAL-2026-18287.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}