dpdgroup-css

{"modified":"2026-08-06T19:16:31Z","published":"2026-08-06T19:16:31Z","schema_version":"1.7.4","id":"MAL-2026-13444","summary":"Malicious code in dpdgroup-css (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (30c55e6b20286d3fc29d7c3bc24932180a5e94a6fe5147393d91da212fc0dc10)\npackage.json declares both preinstall and postinstall lifecycle hooks that run `node setup.js` on every `npm install`. setup.js reads the installer's machine hostname via `os.hostname()` and issues an HTTP GET to a hardcoded bare-IP callback at http://89.116.25.133:4444/dpdgroup-css/<hostname>, with the hostname also carried in an `X-PoC-Host` header. The package name `dpdgroup-css` resembles an internal scope for the DPDgroup courier organization, consistent with a dependency-confusion attack: a private build that resolves this public version instead of an intended internal package auto-runs the beacon and discloses the internal build-host identifier to an external, non-first-party bare-IP endpoint. No legitimate library functionality is present.\n","affected":[{"package":{"ecosystem":"npm","name":"dpdgroup-css"},"versions":["2.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.js","sha256":"52f8120faa2287fb065bf2e7d6834890f13c90d79728838eceb941f35b2b6579","tlsh":"c101fed016f472300ef55edd906b27731121c1897e7a4c85f44c01492fc5c6cd6719d6"},{"path":"package.json","sha256":"b28920d0fbba7bdeb1dbcc7812d73f064d66057ac0b0557a5dd3656634789fad","tlsh":"b8d05b244d156633b4c40ea50837410669758e7b1105b8146393501c49ce6b7a9bf31e"}],"package_integrity":[{"filename":"dpdgroup-css-2.0.1.tgz","hashes":{"sha1":"54799f2fdf313587289b9b39d62d5b71b5648e35","sha512_sri":"sha512-Jfbq0idA3LH6dqlATl8R+ACgpiiXsYZYJVbOkWW4ZeWuncFMo6utM75Rbj4KF/13z4h5pxOzmWyCGlwotNgrkw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dpdgroup-css/v/2.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016757","import_time":"2026-08-06T23:25:07.795817995Z","modified_time":"2026-08-06T19:16:31Z","sha256":"30c55e6b20286d3fc29d7c3bc24932180a5e94a6fe5147393d91da212fc0dc10","source":"amazon-inspector","versions":["2.0.1"]}]}}