{"id":"MAL-2026-18372","summary":"Malicious code in @zmtcdn/components (npm)","details":"@zmtcdn/components@9999.0.0 is a dependency-confusion package with an empty `index.js` and a description of \"Security research PoC\". Its postinstall script runs `node postinstall.js` on npm install, which POSTs the hostname, username, platform, working directory and the names of all environment variables to `https://webhook.site/f52af355-4783-4acb-9de1-5e44b5963025`. It was published by the npm account kill_shs, which also published @zmtcdn/ui with the same script.","modified":"2026-10-29T09:15:04.995815975Z","published":"2026-10-28T09:59:37Z","database_specific":{"iocs":{"urls":["https://webhook.site/f52af355-4783-4acb-9de1-5e44b5963025"],"files":[{"digests":{"sha256":"83ecde574a04b04277a0db8cc868bab08f2222f20183de92a6242433340c08ea"},"note":"postinstall runs `node postinstall.js`, which POSTs host details to a collector (@zmtcdn/components@9999.0.0).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"paths":["postinstall.js"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"fe334f5ef07787eb80c479592ce2834c0644731f14d74422b6a8ee68d94f1bf0"},"note":"Executed by the postinstall script of @zmtcdn/components@9999.0.0."}]}},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@zmtcdn/components"}],"affected":[{"package":{"name":"@zmtcdn/components","ecosystem":"npm","purl":"pkg:npm/%40zmtcdn/components"},"versions":["9999.0.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zmtcdn/components/MAL-2026-18372.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}]}}],"schema_version":"1.9.2","credits":[{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}