MAL-2026-13967

    Dashboard / Malicious Package / MAL-2026-13967

    MAL-2026-13967

    Published: 13 Aug 2026Last Modified: 13 Aug 2026

    Summary: Malicious code in @hzero-front-ui/c7n-ui (npm)

    Details: Source: amazon-inspector (836c7ea4bdd57db38273e1e017c5a977d397cf321d36e5dbdd8060fbcd8ca08e) Package @hzero-front-ui/[email protected] is an empty library whose only functional code runs in preinstall and install lifecycle hooks in package.json. Those hooks collect the installer's identity — whoami, hostname, current working directory, and the package name — base64-encode the concatenation, and send it to a hardcoded attacker-controlled host via HTTPS GET to https://<b64>.callback.m0chan.co.uk and via DNS lookup on subdomains of the same host. The dual HTTP + DNS channel is designed to bypass egress filtering that only allows one of the two. The scoped name mimics an internal package and the 99.99.99 version is a version-bump chosen to win dependency resolution against a legitimate internal registry — the standard dependency-confusion beacon shape. Installing this package causes host reconnaissance data to leave the machine automatically.

    References: https://www.npmjs.com/package/@hzero-front-ui/c7n-ui/v/99.99.99

    Affected packages

    Package

    Name: @hzero-front-ui/c7n-ui

    Purl: pkg:npm/%40hzero-front-ui/c7n-ui

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.99.99
    MAL-2026-13967 | CVE-DB