MAL-2026-13970

    Dashboard / Malicious Package / MAL-2026-13970

    MAL-2026-13970

    Published: 13 Aug 2026Last Modified: 13 Aug 2026

    Summary: Malicious code in @hzero-front-ui/hzero-ui (npm)

    Details: Source: amazon-inspector (a1b33c04eb2fb12d521b76353993517475d9239c9790c085d16c0c3d0a4ba2f9) Package @hzero-front-ui/[email protected] is a scope-lookalike of @hzero-front/hzero-ui with a placeholder version, empty author, generic description, and a trivial index.js. Its package.json preinstall and install lifecycle scripts base64-encode $(whoami):$(hostname):$(pwd):$npm_package_name and send the encoded value to attacker-controlled subdomains of callback.m0chan.co.uk over both HTTPS (curl) and DNS (nslookup). This fires automatically on `npm install`, leaking the installer's OS username, hostname, current working directory, and the internal package name that resolved to this lure — the canonical dependency-confusion beacon shape.

    References: https://www.npmjs.com/package/@hzero-front-ui/hzero-ui/v/99.99.99

    Affected packages

    Package

    Name: @hzero-front-ui/hzero-ui

    Purl: pkg:npm/%40hzero-front-ui/hzero-ui

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.99.99
    MAL-2026-13970 | CVE-DB