mapkit-loader

{"modified":"2026-08-19T03:16:17Z","published":"2026-08-19T03:16:17Z","schema_version":"1.7.4","id":"MAL-2026-14218","summary":"Malicious code in mapkit-loader (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cb2d3c3e234b52b2bbffe7b197f9ec483b2b574667543338b975c99831633c86)\nUnscoped npm package 'mapkit-loader' impersonates the scoped '@apple/mapkit-loader' to intercept mistyped `npx mapkit-loader` invocations. The package.json self-describes as a 'PoC' targeting that confusion. On `npm install`, the postinstall lifecycle script (postinstall.js) unconditionally issues an HTTPS POST to a hardcoded third-party endpoint at npx-monitor-76056.azurewebsites.net/api/pingback carrying a persistent UUID, package version, trigger source ('npm-postinstall'), and timestamp. The UUID is written to ~/.cache/.mapkit-loader-id so subsequent executions (including the bin entry) can be correlated back to the same host. No credential or filesystem exfiltration is present, but the combination of name-confusion targeting an official Apple scope plus install-time beaconing to an author-controlled endpoint is a supply-chain typosquat with an operational tracking channel.\n","affected":[{"package":{"ecosystem":"npm","name":"mapkit-loader"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"1871b3c432015c5575b6a7cfe7feaa54ae9ffaa60b6fc0717c097f8d30f5fc66","tlsh":"b4f059208961dd2331c895ce4c261d05eaf11b172144a81a23d7500ccbddda6a1feb1f"},{"path":"postinstall.js","sha256":"a9037d7f70543fe7bf422c6a5f641e7a88e6fc6cc49d98ea9a6b7f765aa3e491","tlsh":"024123b51ed49a302ef6c696e99a9c037317eb52311371b072cd1b2e97c68441052bef"}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/mapkit-loader/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018322","import_time":"2026-08-19T03:24:22.020084565Z","modified_time":"2026-08-19T03:16:17Z","sha256":"cb2d3c3e234b52b2bbffe7b197f9ec483b2b574667543338b975c99831633c86","source":"amazon-inspector","versions":["1.0.0"]}]}}