@catamania/front-components

{"modified":"2026-08-07T17:07:40Z","published":"2026-08-07T17:07:40Z","schema_version":"1.7.4","id":"MAL-2026-13620","summary":"Malicious code in @catamania/front-components (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (49b66b93df02350bdf848ac2cff8c6a563ac36c1828480891381875453be67f5)\nThe package's postinstall.js runs automatically on npm install and collects host reconnaissance data — os.hostname(), os.userInfo() username, process.cwd(), and the list of environment variable names from process.env — then POSTs the JSON payload via https.request to a hardcoded webhook.site capture URL (webhook.site/4b333dc6-9783-4f6b-82fa-db9795caa938). Environment variable values are masked but key names and host identifiers still leave the installer's machine on every install. The package's index.js contains only a trivial 5-line Vue button component, which does not correspond to the install-time beaconing behavior; the shape is consistent with a scoped dependency-confusion or reconnaissance probe measuring which internal build hosts resolve the @catamania scope to the public registry.\n","affected":[{"package":{"ecosystem":"npm","name":"@catamania/front-components"},"versions":["1.0.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"260c98caffc90f037cb4f3f642c90861aa69253bc2e45f87ec604225272c2069","tlsh":"23017bf491b396501ff5a1c4a484dc07516bd201760778b0b6d44399af94af818b18e5"},{"path":"package.json","sha256":"5d4d9f8959e93b4d9f9b1164394e61352588d5e6396c79efda7f603fe7139062","tlsh":"ccd012701c50766378c90a664a33554f55f14d2e6105b41c17d760b443cb6bbd8ab32e"}],"package_integrity":[{"filename":"front-components-1.0.5.tgz","hashes":{"sha1":"56ae673295a155f84c233bef4d3d2dbed8ea5c92","sha512_sri":"sha512-SsCkBlqhf//cuarQ9eoIhnYr5HAfqMC7eA+LoTTbcfS5vIgR72mU3SXKGTrywvDPYMMXv5qUrRQxkNU2bAEvPg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@catamania/front-components/v/1.0.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017120","import_time":"2026-08-07T17:23:16.832280946Z","modified_time":"2026-08-07T17:07:40Z","sha256":"49b66b93df02350bdf848ac2cff8c6a563ac36c1828480891381875453be67f5","source":"amazon-inspector","versions":["1.0.5"]}]}}