@aspect-adv-ui/consent-manager

{"modified":"2026-09-08T21:16:32Z","published":"2026-09-08T21:05:03Z","schema_version":"1.7.4","id":"MAL-2026-16050","summary":"Malicious code in @aspect-adv-ui/consent-manager (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b30b507d6c71f746b0af2d19cbbb85357f15189e7e93118c75b4cb215adc0ece)\n@aspect-adv-ui/consent-manager 2.4.1 declares a postinstall hook (`node setup.js`) that fires automatically on every `npm install`. setup.js issues an HTTPS GET to a hardcoded webhook.site inspection endpoint (https://webhook.site/kapper), sending install-event metadata (source IP, TLS/user-agent fingerprint) to an author-controlled third-party collector. The package is advertised as a small GDPR/CCPA consent-bar React component with no native build, no binary, and no legitimate install-time work; the postinstall exists solely to run this beacon. webhook.site is a public request-inspection service commonly used as an anonymous exfiltration/beacon endpoint, and the beacon is not disclosed or opt-in.\n","affected":[{"package":{"ecosystem":"npm","name":"@aspect-adv-ui/consent-manager"},"versions":["2.4.0","2.4.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.js","sha256":"8fd5c4cf372651bf994c9b00a18939cc0ef6f0a20eede482bee1dea99d220e35","tlsh":"c1a022f202acf008202008ccc003f0ccf083c02c8800e38acb80033a0e200f23e0abe8"},{"path":"index.js","sha256":"56ff65922ca8b50bc26bcfb498360417313c0a0350c2c09b561a7ccafea1e9dd","tlsh":"4ac09b5bd1d3351f47971d305017835c79fcc679150544d15e0cc2d447247537271dc4"}],"package_integrity":[{"filename":"consent-manager-2.4.0.tgz","hashes":{"sha1":"78b5088f52af111e959a2fb7f31b03edc207b1f1","sha512_sri":"sha512-EI1G4n2tkLsA9VZFQvxMHOwfz7mEIk1MJQ/R7NmLpNJZtdAco/MOYVSSew417UY58JUGkG8SzMAnzQgvg81V1g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@aspect-adv-ui/consent-manager/v/2.4.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@aspect-adv-ui/consent-manager/v/2.4.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019718","import_time":"2026-09-08T21:14:31.10493083Z","modified_time":"2026-09-08T21:05:14Z","sha256":"2a9870fffe0914ff64d484261982e977960fdc61ebc8a7aa2004b996af1037b2","source":"amazon-inspector","versions":["2.4.0"]},{"id":"IN-MAL-2026-019717","import_time":"2026-09-08T21:14:31.062257971Z","modified_time":"2026-09-08T21:05:03Z","sha256":"b30b507d6c71f746b0af2d19cbbb85357f15189e7e93118c75b4cb215adc0ece","source":"amazon-inspector","versions":["2.4.1"]}]}}