{"id":"MAL-2026-18449","summary":"Malicious code in ms-client-portal (npm)","details":"ms-client-portal is a dependency-confusion package with no functional code; its README says the name is an internal project name exposed in the production web bundle of a health-sector client portal. Its preinstall and postinstall scripts each run a `node -e` one-liner on npm install that sends an HTTP GET to `http://38.242.235.206/depconf/ms-client-portal/preinstall` (and `/postinstall`) with the user name (`USER` or `USERNAME`), hostname and working directory in the query string. The npm account amahrou1a published versions 1.0.0 and 10.0.0 on 2026-10-31, and earlier the same day two more packages, internal-renderers and pandafortunerush, with the same beacon to the same server.","modified":"2026-11-02T05:45:05.459796615Z","published":"2026-10-31T13:10:23Z","database_specific":{"iocs":{"urls":["http://38.242.235.206/depconf/ms-client-portal/preinstall","http://38.242.235.206/depconf/ms-client-portal/postinstall"],"files":[{"paths":["package.json"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"4e69a9ec1b1080488719673e44b4b5652d0b2ee55cefa61aa0ea1d0b18b9ddd7"},"note":"preinstall and postinstall send the user name, hostname and working directory to 38.242.235.206 (ms-client-portal@1.0.0)."},{"paths":["package.json"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"1760f11a7252576717913388ed01e169649f477ed238fd361356356d1a99aa77"},"note":"preinstall and postinstall send the user name, hostname and working directory to 38.242.235.206 (ms-client-portal@10.0.0)."}],"ips":["38.242.235.206"]}},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ms-client-portal"}],"affected":[{"package":{"name":"ms-client-portal","ecosystem":"npm","purl":"pkg:npm/ms-client-portal"},"versions":["1.0.0","10.0.0"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ms-client-portal/MAL-2026-18449.json"}}],"schema_version":"1.9.2","credits":[{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}