@hzero-front-ui/hzero-ui

{"modified":"2026-08-13T21:06:51Z","published":"2026-08-13T21:06:51Z","schema_version":"1.7.4","id":"MAL-2026-13970","summary":"Malicious code in @hzero-front-ui/hzero-ui (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a1b33c04eb2fb12d521b76353993517475d9239c9790c085d16c0c3d0a4ba2f9)\nPackage @hzero-front-ui/hzero-ui@99.99.99 is a scope-lookalike of @hzero-front/hzero-ui with a placeholder version, empty author, generic description, and a trivial index.js. Its package.json preinstall and install lifecycle scripts base64-encode $(whoami):$(hostname):$(pwd):$npm_package_name and send the encoded value to attacker-controlled subdomains of callback.m0chan.co.uk over both HTTPS (curl) and DNS (nslookup). This fires automatically on `npm install`, leaking the installer's OS username, hostname, current working directory, and the internal package name that resolved to this lure — the canonical dependency-confusion beacon shape.\n","affected":[{"package":{"ecosystem":"npm","name":"@hzero-front-ui/hzero-ui"},"versions":["99.99.99"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"fcd4c5dcbab4d2bd11867f5c9be10dedb6cfb073a43b9e91d18557c94c2d8bc1","tlsh":"bc117a2541319eb6a9e24fb01c00aa2d65fdabaf317ebb49620e4a1f001d16171af64f"}],"package_integrity":[{"filename":"hzero-ui-99.99.99.tgz","hashes":{"sha1":"73e292a995d25e0ad20b2c85f3f9eff14e3b5fbd","sha512_sri":"sha512-M6UeOFs8ueM7H7Vpw4l2b5AzH7WZTPFXniLDf2FcInaAT5Qmbyq7kmM/WdV682BeRtsPGXfMNFyjRnf9wjZZfA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@hzero-front-ui/hzero-ui/v/99.99.99"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017673","import_time":"2026-08-13T21:20:57.017177222Z","modified_time":"2026-08-13T21:06:51Z","sha256":"a1b33c04eb2fb12d521b76353993517475d9239c9790c085d16c0c3d0a4ba2f9","source":"amazon-inspector","versions":["99.99.99"]}]}}