@hzero-front-ui/cfg

{"modified":"2026-08-13T21:07:19Z","published":"2026-08-13T21:07:19Z","schema_version":"1.7.4","id":"MAL-2026-13968","summary":"Malicious code in @hzero-front-ui/cfg (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d280060b3d704c67c4a2cc853fde425220e6a3606f71269daa8a9b3e74052f6d)\npackage.json declares preinstall and install lifecycle scripts that, on npm install, collect whoami, hostname, current working directory, and npm_package_name, base64-encode the concatenation, and transmit it to subdomains of callback.m0chan.co.uk via both an HTTPS GET (curl to https://<sub>.callback.m0chan.co.uk/<b64>) and a DNS lookup (nslookup against <pkgdns>.<sub>.callback.m0chan.co.uk). The 99.99.99 version and scoped name pattern are consistent with a dependency-confusion beacon targeting an internal @hzero-front-ui scope.\n","affected":[{"package":{"ecosystem":"npm","name":"@hzero-front-ui/cfg"},"versions":["99.99.99"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"f532ea3e99798c843a7b88511915d8dd3733c58d932969dbb6abd7c53fd0cf48","tlsh":"ce119c2541319eb6a9e24fb01c00ab2d65fdabaf307ebb49620d4a2f001d16170ef64e"}],"package_integrity":[{"filename":"cfg-99.99.99.tgz","hashes":{"sha1":"fc05c4540b6c57aa2a562d6b7d210817ab0d7a05","sha512_sri":"sha512-fR7QXsTGeTHM6/R+7JcKNGFQw4XQy5uZoOlkLpW3C+JL8W1ujDH+ieoVaaQORa6P3EWPmQcu+O7EyfvoKpafSA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@hzero-front-ui/cfg/v/99.99.99"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017676","import_time":"2026-08-13T21:20:57.118328727Z","modified_time":"2026-08-13T21:07:19Z","sha256":"d280060b3d704c67c4a2cc853fde425220e6a3606f71269daa8a9b3e74052f6d","source":"amazon-inspector","versions":["99.99.99"]}]}}