com.apple.unityplugin.storekit

{"modified":"2026-09-23T14:10:47Z","published":"2026-09-23T14:10:47Z","schema_version":"1.7.4","id":"MAL-2026-16477","summary":"Malicious code in com.apple.unityplugin.storekit (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (920277566757bdc38563c7e2150e906790478cbd7a0c48f0bb53004e82eec4ca)\nThe package impersonates an Apple/Unity StoreKit internal namespace (com.apple.unityplugin.storekit) and, on require(), index.js performs an HTTPS GET to a hardcoded Project Discovery Interactsh (oast.fun) subdomain, transmitting the package name, os.platform(), and os.hostname() as query parameters (target: https://dapnhid534ch06s9vpm0mbg1httu5gytc.oast.fun). The behavior is unconditional, undocumented, and fires at module load with no caller opt-in. The name/scope, the author claim of 'Apple, Inc', and the OAST callback destination are the standard dependency-confusion reconnaissance shape: the beacon confirms that an internal build system has resolved the attacker's public package instead of Apple's private one, and leaks the internal hostname of the machine that resolved it.\n","affected":[{"package":{"ecosystem":"npm","name":"com.apple.unityplugin.storekit"},"versions":["1.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"29dab8bc128d6a5323f474175e9eb6df68ba488480dbbf36c04dc4ef62e91f0b","tlsh":"55e061f442d34b715f6047c05042244db54795757560e680f78942a45fd3db15931efc"}],"package_integrity":[{"filename":"com.apple.unityplugin.storekit-1.0.2.tgz","hashes":{"sha1":"bf63c5ce089c07285eccc7ae69e671bacca7f756","sha512_sri":"sha512-+eN7chIlxd2xfgpoFJk2eqUFyHIXB5CsmF67Cg6JaYrhfeYkrkG7aUIfAwGxNG1N6BFMk/yfcmo1zQvJIZAvag=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/com.apple.unityplugin.storekit/v/1.0.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020491","import_time":"2026-09-23T14:19:31.869628617Z","modified_time":"2026-09-23T14:10:47Z","sha256":"920277566757bdc38563c7e2150e906790478cbd7a0c48f0bb53004e82eec4ca","source":"amazon-inspector","versions":["1.0.2"]}]}}