MAL-2026-18373

Dashboard / Malicious Package / MAL-2026-18373

MAL-2026-18373

Summary: Malicious code in @zmtcdn/ui (npm)

Details: @zmtcdn/ui 9999.0.0 and 9999.0.7 are dependency-confusion packages with an empty `index.js` and a description of "Security research PoC". Their postinstall script runs `node postinstall.js` on npm install, which POSTs the hostname, username, platform, working directory and the names of all environment variables to `https://www.hinny.shop/api`. They were published by the npm account kill_shs, which also published @zmtcdn/components with the same script. Source: amazon-inspector (e648b4f06d9e84a66379d2b099f89a9d669aa5f21f0159ceed861a37c590262f) The postinstall.js lifecycle script runs automatically on `npm install` and collects installer-identifying data — `os.hostname()`, `os.platform()`, `os.userInfo().username`, `process.cwd()`, the list of `process.env` key names, and a timestamp — then POSTs the JSON blob via `https.request` to the hardcoded endpoint https://www.hinny.shop/api. The package name uses a vendor-style scope (`@zmtcdn/ui`) and an implausibly high version (9999.0.7) consistent with a dependency-confusion lure, and the fetch destination is unrelated to any declared publisher. No user opt-in, no documentation of the beacon, and no legitimate functional purpose for sending this data off-host at install time.

References: https://www.npmjs.com/package/@zmtcdn/ui, https://www.npmjs.com/package/@zmtcdn/ui/v/9999.0.0, https://www.npmjs.com/package/@zmtcdn/ui/v/9999.0.7