syft-acp-core

{"schema_version":"1.7.4","id":"MAL-2026-10765","published":"2026-07-16T00:00:00Z","modified":"2026-08-06T14:21:56.300451475Z","summary":"Malicious code in syft-acp-core (npm)","details":"The syft-acp-core package was published to the npm registry by user 'ada8877' (maintainer email k3mlol@proton.me) as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention (an ACP component library) of a target organization, so that a misconfigured resolver installs this public lookalike instead of the intended private dependency.\n\nThe package declares a preinstall hook (\"npm install @sentry/node && node examples/verify.js\") that executes automatically at npm install time, before any application code runs. The bundled examples/verify.js initializes the @sentry/node client against a hardcoded, attacker-controlled Sentry DSN with sendDefaultPii enabled, resolves the installing host's public egress IP address by requesting Cloudflare's /cdn-cgi/trace endpoint (using a spoofed desktop-browser User-Agent to bypass bot challenges), then deliberately triggers a runtime exception and captures it. Flushing the event beacons the collected host telemetry (public IP plus Sentry default PII such as hostname, OS username and runtime/environment metadata) to the attacker's Sentry ingest endpoint at o4510485815754752.ingest.us.sentry.io.\n\nEach impersonated namespace in the campaign beacons to a distinct Sentry project ID, letting the operator attribute successful installs to specific victim organizations — behaviour consistent with a dependency-confusion reconnaissance beacon rather than legitimate error monitoring. The install-time payload is byte-for-byte identical to the earlier 'click2ai' campaign, sharing the same Sentry organization (o4510485815754752) and a related ProtonMail maintainer identity, and differs only in the package name and target DSN. This package's beacon targets Sentry project 4511744089718784.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (46bcb30b019b3455aa12747ac76d9aae4cc307eff76b61075c67c01304bdf625)\npackage.json declares a preinstall hook `npm install @sentry/node && node examples/verify.js` that fires on every `npm install`. examples/verify.js resolves the installer's public IP via https://www.cloudflare.com/cdn-cgi/trace, attaches it as ip_address on a Sentry user, and captures a synthetic exception. The event is uploaded to a hardcoded DEFAULT_DSN pointing at Sentry org o4510485815754752.ingest.us.sentry.io/4511744089718784, which the installer did not configure. src/index.js additionally hardcodes the same DEFAULT_DSN as the library's default and forces sendDefaultPii: true, so consumers that call init() without supplying their own DSN or SENTRY_DSN environment variable send their captured errors and PII to the same author-controlled Sentry project instead of their own.\n","affected":[{"package":{"name":"syft-acp-core","ecosystem":"npm"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["16.0.0","1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"b42ceeb59fed17577919f3dd06cba981d06cefaaf27d7e73f782198262dcdb48","tlsh":"f3f078518d742f2315c4f3a16c6901466330ce4701a43d193acb022d4b4c72f24ff59d"},{"path":"src/index.js","sha256":"812dd11f749a704ebddfdea4660e6207769071dacde571843028c915f95f71e7","tlsh":"0c12959a34f6632301e250f0025f90d97365c67a3379a9e071598be92fc90b8d6b3ec9"}],"package_integrity":[{"filename":"syft-acp-core-16.0.0.tgz","hashes":{"sha1":"031c1bc3b7c61efe4a3323374803b4e4b75948b6","sha512_sri":"sha512-a96/ePvxgyhWSl6C4qFvivWI6LEwA9ItzdWdVK3rbHqotUovEZkDol9QCOfjOx3up9vOtUKB6X9zBZhmdFet1w=="}}]},"iocs":{"domains":["o4510485815754752.ingest.us.sentry.io"],"urls":["https://e82e1244d311e1f83fd57d89db4d62a3@o4510485815754752.ingest.us.sentry.io/4511744089718784"]}}}],"references":[{"type":"WEB","url":"https://www.npmjs.com/package/syft-acp-core"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/syft-acp-core/v/16.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/syft-acp-core/v/1.0.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-011278","import_time":"2026-08-04T22:30:08.650120035Z","modified_time":"2026-08-04T21:58:15Z","sha256":"46bcb30b019b3455aa12747ac76d9aae4cc307eff76b61075c67c01304bdf625","source":"amazon-inspector","versions":["16.0.0"]},{"id":"IN-MAL-2026-016365","import_time":"2026-08-06T14:19:45.379005976Z","modified_time":"2026-08-06T13:10:53Z","sha256":"875123554120100d296bb41af939b3dd19053d7c51ce37b7f83dbfa446ef5b4e","source":"amazon-inspector","versions":["1.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"SafeDep","contact":["https://safedep.io"],"type":"FINDER"}]}