{"id":"MAL-2026-18373","summary":"Malicious code in @zmtcdn/ui (npm)","details":"@zmtcdn/ui 9999.0.0 and 9999.0.7 are dependency-confusion packages with an empty `index.js` and a description of \"Security research PoC\". Their postinstall script runs `node postinstall.js` on npm install, which POSTs the hostname, username, platform, working directory and the names of all environment variables to `https://www.hinny.shop/api`. They were published by the npm account kill_shs, which also published @zmtcdn/components with the same script.","modified":"2026-10-29T09:15:04.990921350Z","published":"2026-10-28T07:27:15Z","database_specific":{"iocs":{"urls":["https://www.hinny.shop/api"],"domains":["hinny.shop"],"files":[{"paths":["package.json"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"89d6f6810a40838b4a82e4f8be92f9f22541707ecef8e856ebf522ab0a3b9053"},"note":"postinstall runs `node postinstall.js`, which POSTs host details to a collector (@zmtcdn/ui@9999.0.0)."},{"paths":["postinstall.js"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"8bbd4c1f109d109d0953fb78d35c0483207a049d0220e3470d22b6d2403d1be6"},"note":"Executed by the postinstall script of @zmtcdn/ui@9999.0.0."},{"source":"PACKAGE_ARCHIVE","digests":{"sha256":"f1b913f1a0e6d98c104fd8c37fc9569e72a25ee521c9be1a3745cac57c699693"},"note":"postinstall runs `node postinstall.js`, which POSTs host details to a collector (@zmtcdn/ui@9999.0.7).","paths":["package.json"]},{"paths":["postinstall.js"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"8bbd4c1f109d109d0953fb78d35c0483207a049d0220e3470d22b6d2403d1be6"},"note":"Executed by the postinstall script of @zmtcdn/ui@9999.0.7."}]}},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@zmtcdn/ui"}],"affected":[{"package":{"name":"@zmtcdn/ui","ecosystem":"npm","purl":"pkg:npm/%40zmtcdn/ui"},"versions":["9999.0.0","9999.0.7"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zmtcdn/ui/MAL-2026-18373.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}]}}],"schema_version":"1.9.2","credits":[{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}