MAL-2026-14218

    Dashboard / Malicious Package / MAL-2026-14218

    MAL-2026-14218

    Published: 19 Aug 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in mapkit-loader (npm)

    Details: Source: amazon-inspector (cb2d3c3e234b52b2bbffe7b197f9ec483b2b574667543338b975c99831633c86) Unscoped npm package 'mapkit-loader' impersonates the scoped '@apple/mapkit-loader' to intercept mistyped `npx mapkit-loader` invocations. The package.json self-describes as a 'PoC' targeting that confusion. On `npm install`, the postinstall lifecycle script (postinstall.js) unconditionally issues an HTTPS POST to a hardcoded third-party endpoint at npx-monitor-76056.azurewebsites.net/api/pingback carrying a persistent UUID, package version, trigger source ('npm-postinstall'), and timestamp. The UUID is written to ~/.cache/.mapkit-loader-id so subsequent executions (including the bin entry) can be correlated back to the same host. No credential or filesystem exfiltration is present, but the combination of name-confusion targeting an official Apple scope plus install-time beaconing to an author-controlled endpoint is a supply-chain typosquat with an operational tracking channel.

    References: https://www.npmjs.com/package/mapkit-loader/v/1.0.0

    Affected packages

    Package

    Name: mapkit-loader

    Purl: pkg:npm/mapkit-loader

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-14218 | CVE-DB