MAL-2026-16050

    Dashboard / Malicious Package / MAL-2026-16050

    MAL-2026-16050

    Published: 8 Sept 2026Last Modified: 8 Sept 2026

    Summary: Malicious code in @aspect-adv-ui/consent-manager (npm)

    Details: Source: amazon-inspector (b30b507d6c71f746b0af2d19cbbb85357f15189e7e93118c75b4cb215adc0ece) @aspect-adv-ui/consent-manager 2.4.1 declares a postinstall hook (`node setup.js`) that fires automatically on every `npm install`. setup.js issues an HTTPS GET to a hardcoded webhook.site inspection endpoint (https://webhook.site/kapper), sending install-event metadata (source IP, TLS/user-agent fingerprint) to an author-controlled third-party collector. The package is advertised as a small GDPR/CCPA consent-bar React component with no native build, no binary, and no legitimate install-time work; the postinstall exists solely to run this beacon. webhook.site is a public request-inspection service commonly used as an anonymous exfiltration/beacon endpoint, and the beacon is not disclosed or opt-in.

    References: https://www.npmjs.com/package/@aspect-adv-ui/consent-manager/v/2.4.0, https://www.npmjs.com/package/@aspect-adv-ui/consent-manager/v/2.4.1

    Affected packages

    Package

    Name: @aspect-adv-ui/consent-manager

    Purl: pkg:npm/%40aspect-adv-ui/consent-manager

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.4.0
    2.4.1