MAL-2026-11427
Dashboard / Malicious Package / MAL-2026-11427
MAL-2026-11427
Summary: Malicious code in pp-react-worldready (npm)
Details: Source: amazon-inspector (6cd3313519c0ef5edb290227d7d183c3d5344473351bc10bcf6a5d09e51c32a7) package.json declares a preinstall hook that runs vishu.js on npm install. The script resolves the installer's public IP via api.ipify.org, reads os.hostname() and CI/GitHub Actions environment variables (CI, GITHUB_ACTIONS, GITHUB_WORKFLOW, GITHUB_RUN_ID), and sends them as query parameters to a hardcoded webhook.site collector at https://webhook.site/1b840cbf-f1a4-4d79-bf11-f1ef62949110. It also performs a DNS lookup embedding the hostname as a subdomain of your-collab-domain.oastify.com (Burp Collaborator) as an out-of-band exfiltration channel. This is the canonical dependency-confusion reconnaissance beacon shape: identify internal build hosts that mistakenly resolve the package name from the public registry. Source: ossf-package-analysis (6a0cb104ba7e29ae2e20cb4d191f5a1cb0a74de3a26cc06e9e6369d5bbee94e5) The OpenSSF Package Analysis project identified 'pp-react-worldready' @ 1.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.
Affected packages
Package
Name: pp-react-worldready
Purl: pkg:npm/pp-react-worldready
Affected ranges
Type: N/A
Events:
