pp-react-worldready-v5

{"modified":"2026-08-05T13:02:28Z","published":"2026-08-05T13:02:28Z","schema_version":"1.7.4","id":"MAL-2026-12419","summary":"Malicious code in pp-react-worldready-v5 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (435cbd5d4dffc9d7e61222051c82a376bf6dd5a484760803953484ea0fa21b39)\nThe tarball contains only package.json and vishu.js; the declared main (index.js) is absent, so the package has no library functionality. package.json.scripts.preinstall runs `node vishu.js`, which fires automatically on `npm install`. vishu.js resolves the installer's public IP via api.ipify.org, reads os.hostname() and GitHub Actions environment variables (CI, GITHUB_ACTIONS, GITHUB_WORKFLOW, GITHUB_RUN_ID, GITHUB_RUN_NUMBER, GITHUB_RUN_ATTEMPT), and sends them as query parameters in an HTTPS GET to https://webhook.site/1b840cbf-f1a4-4d79-bf11-f1ef62949110. It also issues a DNS lookup for `ping-<hostname>.your-collab-domain.oastify.com`, encoding the installer's hostname as a subdomain of a Burp Collaborator (OAST) host for out-of-band exfiltration. The package name resembles a typosquat pattern consistent with dependency-confusion reconnaissance.\n","affected":[{"package":{"ecosystem":"npm","name":"pp-react-worldready-v5"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"vishu.js","sha256":"2ce5acaf6ac8cd77b4bc4a8329d6f39831cc2e2ed739a0bd1a9284789ba7aa1f","tlsh":"bd313e4ca2f7962004f263c8162b941e605be1933729ce917a9c02521faad3882e3bd8"},{"path":"package.json","sha256":"3e3a925310ab66b356a8282b256a5ceda91e22624c8cc6441f940141d1b9ff52","tlsh":"91e0c2744e11a2b716c109960d2a944232a54f6f11587c486beb1428418f7b788bf36d"}],"package_integrity":[{"filename":"pp-react-worldready-v5-1.0.0.tgz","hashes":{"sha1":"7c5491fb6c0837b9d7fb20a78bbaf970e525dd3e","sha512_sri":"sha512-NM21AsFB7MDKbGyNisc5+oKNqt31S+Q92n7kOGrB1uhzsOTzT1y99yCnAfJY0AT+F7Nz1x0rL7JNEshqziO1DQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/pp-react-worldready-v5/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014859","import_time":"2026-08-05T13:08:51.522219587Z","modified_time":"2026-08-05T13:02:28Z","sha256":"435cbd5d4dffc9d7e61222051c82a376bf6dd5a484760803953484ea0fa21b39","source":"amazon-inspector","versions":["1.0.0"]}]}}