{"id":"MAL-2026-18686","summary":"Malicious code in cs-core-api-phoenix (npm)","details":"cs-core-api-phoenix 5.1.0 is a dependency-confusion package: its postinstall script reads the OS user name and hostname and POSTs them to https://nathanaccacio.com/collect on every install. It targets an internal-looking name and collects data from whoever installs it, without consent.","modified":"2026-11-05T05:15:04.455518094Z","published":"2026-10-26T00:00:00Z","database_specific":{"iocs":{"ips":[],"urls":["https://nathanaccacio.com/collect"],"domains":["nathanaccacio.com"],"files":[{"digests":{"sha256":"310147b5035c63078181fa858763852cf40cde75c8a1439428aab8f10510d898"},"paths":["index.js"]},{"digests":{"sha256":"f351b64f04f8cbc6ff1480d76c77b590ee5887b07f5675ec9cca7e1ca856c6ac"},"paths":["regex-linter-poc/index.js"]}]}},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cs-core-api-phoenix"}],"affected":[{"package":{"name":"cs-core-api-phoenix","ecosystem":"npm","purl":"pkg:npm/cs-core-api-phoenix"},"versions":["5.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cs-core-api-phoenix/MAL-2026-18686.json"}}],"schema_version":"1.9.2","credits":[{"name":"CyberXYZ","contact":["https://cyberxyz.io"],"type":"FINDER"}]}