@hzero-front-ui/c7n-ui

{"modified":"2026-08-13T21:07:10Z","published":"2026-08-13T21:07:10Z","schema_version":"1.7.4","id":"MAL-2026-13967","summary":"Malicious code in @hzero-front-ui/c7n-ui (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (836c7ea4bdd57db38273e1e017c5a977d397cf321d36e5dbdd8060fbcd8ca08e)\nPackage @hzero-front-ui/c7n-ui@99.99.99 is an empty library whose only functional code runs in preinstall and install lifecycle hooks in package.json. Those hooks collect the installer's identity — whoami, hostname, current working directory, and the package name — base64-encode the concatenation, and send it to a hardcoded attacker-controlled host via HTTPS GET to https://<b64>.callback.m0chan.co.uk and via DNS lookup on subdomains of the same host. The dual HTTP + DNS channel is designed to bypass egress filtering that only allows one of the two. The scoped name mimics an internal package and the 99.99.99 version is a version-bump chosen to win dependency resolution against a legitimate internal registry — the standard dependency-confusion beacon shape. Installing this package causes host reconnaissance data to leave the machine automatically.\n","affected":[{"package":{"ecosystem":"npm","name":"@hzero-front-ui/c7n-ui"},"versions":["99.99.99"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"48ef54289b4c899a3514031e40ae296c4d049cfdae3cc211b4ef83f689ad4fbe","tlsh":"69119c6541319eb6a8e24fb01c00ab2d66fdabaf317ebb49620d4a1f001d17170ef64f"}],"package_integrity":[{"filename":"c7n-ui-99.99.99.tgz","hashes":{"sha1":"f17d992c995de4ec0e2326fb2676827a62cc1101","sha512_sri":"sha512-oT43SRAjVgD6bdMVeQEaTvAH1X65srfYnkX5v8FaierwCXXJPc34Z4WJ9xeeMXK7QcQtmDAxZfySr4I0sCRjog=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@hzero-front-ui/c7n-ui/v/99.99.99"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017675","import_time":"2026-08-13T21:20:57.073049587Z","modified_time":"2026-08-13T21:07:10Z","sha256":"836c7ea4bdd57db38273e1e017c5a977d397cf321d36e5dbdd8060fbcd8ca08e","source":"amazon-inspector","versions":["99.99.99"]}]}}