MAL-2026-3653

Dashboard / Malicious Package / MAL-2026-3653

MAL-2026-3653

Summary: Malicious code in @design-system-coopeuch/web (npm)

Details: Source: amazon-inspector (a871445c3913d747a2f1383bcfdac02d6dec26ddb2053260340284cf4ee02233) Package `@design-system-coopeuch/[email protected]` is a dependency-confusion squat of an internal-looking scope, published at an inflated 999.x version to override any private registry copy. `package.json` declares a `preinstall` hook that runs `cb.js`, which collects installer host identifiers (`os.hostname()`, cwd, install directory, `id`, `uname -a`, OS release info, and the full list of `process.env` key names) and POSTs them as JSON over cleartext HTTP to a hardcoded bare IP, `http://157.173.126.113:8443/dep-confusion` (cb.js line 20: `hostname: "157.173.126.113", port: 8443, path: "/dep-confusion", method: "POST"`). The beacon fires automatically on `npm install` without user consent. Although the package description self-labels as an "authorized bug bounty PoC," any unintended installer has their host fingerprint exfiltrated to an attacker-controlled endpoint. The combination of internal-scope impersonation, inflated version, and install-time beacon to a bare IP is the canonical dependency-confusion attack shape. Source: ossf-package-analysis (e91609499d64cf31c94ddc3047d4c189c64e8e5f09c3da98cb3fec5c05978823) The OpenSSF Package Analysis project identified '@design-system-coopeuch/web' @ 999.0.0 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

References: https://www.npmjs.com/package/@design-system-coopeuch/web/v/999.0.4, https://www.npmjs.com/package/@design-system-coopeuch/web/v/999.0.0