@capsense/ccx-welcome-page

{"schema_version":"1.7.4","id":"MAL-2026-18294","published":"2026-10-25T17:34:58Z","modified":"2026-10-29T14:15:54.435730157Z","aliases":["GHSA-phgq-4c2g-6xpx"],"related":["MAL-2026-18295"],"summary":"Malicious code in @capsense/ccx-welcome-page (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0f63b73ae5e707b0eecee16f97f8ab26b350d135547448fbf6e005ba33303060)\nThe package publishes under the @capsense scope at version 99.99.100 and wires all three npm lifecycle hooks (preinstall, install, postinstall) to run beacon.js. beacon.js collects os.hostname(), os.userInfo(), and os.platform() and sends the installer's hostname, username, and OS to two hardcoded attacker-controlled collectors: a DNS lookup against the Interactsh OAST subdomain dbf2v9d8dg559apcd93guf6i7uxrn5coo.oast.pro and an HTTPS GET to webhook.site/59675304-bec1-4ca0-8409-8d37b65ec116 with the host identity in the query string. The scope+version combination (public @capsense scope, implausibly high 99.99.100) is the canonical dependency-confusion shape, intended to override a private internal @capsense package during resolution and fire the beacon on any internal build that pulls the public version. The self-label as a 'dependency-confusion PoC' does not change the behavior: any installer whose build resolves this package has their host identity shipped to third-party collectors without consent.\n\n## Source: ghsa-malware (ecd5f17a5f3f4128a9a96453aa873b5f447eccc12563702e0e84d8b63b0719b8)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n\n## Source: ossf-package-analysis (08a76d2425b34728eb502d47ba660eefd26e944864de58d8022e82c367dd55b2)\nThe OpenSSF Package Analysis project identified '@capsense/ccx-welcome-page' @ 99.99.100 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"name":"@capsense/ccx-welcome-page","ecosystem":"npm"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["99.99.100","99.99.99","0.0.0-stage"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"beacon.js","sha256":"1e2950c3e5f1bc27057224195e55566f4909d75b0de8bee9acf64caa280b6df3","tlsh":"7c3155af4638a5245370b1f4c55f412d8af3e278078557d8942cc3519fb983c4253ebc"},{"path":"package.json","sha256":"8065387f0e043d719a2d2900373657a009fb5ce91018b1fd65713e47ab9a5f95","tlsh":"61f0a2245818ab375de202eb1c73196dba718ee693146d08579b4144e34fb9e113b35a"}],"package_integrity":[{"filename":"ccx-welcome-page-99.99.99.tgz","hashes":{"sha1":"f71b57d4069e4404c741ed6082508ae47c3c7526","sha512_sri":"sha512-ubgsdyNFpjuOkPNWdqZ+N67gpBMQzUpdrqayKxkk3Q0FzSfvqa2Kic+N3AR4RfJkJLs1vDIhoTb93S9igrSO+w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@capsense/ccx-welcome-page/v/99.99.99"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@capsense/ccx-welcome-page/v/99.99.100"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-phgq-4c2g-6xpx"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@capsense/ccx-welcome-page"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@capsense/ccx-welcome-page/v/0.0.0-stage"}],"database_specific":{"iocs":{"domains":["dbf2v9d8dg559apcd93guf6i7uxrn5coo.oast.pro"],"files":[{"digests":{"sha256":"8065387f0e043d719a2d2900373657a009fb5ce91018b1fd65713e47ab9a5f95"},"note":"preinstall, install and postinstall scripts each run `node beacon.js <stage>`, which sends hostname and username to an oast.pro interactsh host and webhook.site (@capsense/ccx-welcome-page@99.99.99).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"1e2950c3e5f1bc27057224195e55566f4909d75b0de8bee9acf64caa280b6df3"},"note":"Executed by the preinstall, install and postinstall scripts of @capsense/ccx-welcome-page@99.99.99.","paths":["beacon.js"],"source":"PACKAGE_ARCHIVE"}],"urls":["https://webhook.site/59675304-bec1-4ca0-8409-8d37b65ec116"]},"malicious-packages-origins":[{"import_time":"2026-10-25T18:19:33.499559883Z","modified_time":"2026-10-25T18:19:29Z","sha256":"08a76d2425b34728eb502d47ba660eefd26e944864de58d8022e82c367dd55b2","source":"ossf-package-analysis","versions":["99.99.100"]},{"id":"IN-MAL-2026-021738","import_time":"2026-10-26T06:39:39.191385525Z","modified_time":"2026-10-26T05:59:34Z","sha256":"0c2b35b8f84afc6a83d56e3705c65c7236bc1d0c51974fabdb68c65c8637ea3d","source":"amazon-inspector","versions":["99.99.99"]},{"id":"IN-MAL-2026-021739","import_time":"2026-10-26T06:39:39.283486083Z","modified_time":"2026-10-26T05:59:41Z","sha256":"0f63b73ae5e707b0eecee16f97f8ab26b350d135547448fbf6e005ba33303060","source":"amazon-inspector","versions":["99.99.100"]},{"id":"GHSA-phgq-4c2g-6xpx","import_time":"2026-10-26T16:31:42.743513122Z","modified_time":"2026-10-26T16:20:00Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"ecd5f17a5f3f4128a9a96453aa873b5f447eccc12563702e0e84d8b63b0719b8","source":"ghsa-malware"},{"id":"IN-MAL-2026-022292","import_time":"2026-10-29T14:14:40.698246471Z","modified_time":"2026-10-29T14:13:48Z","sha256":"f7983b1fc81a9d163885053a4eb8ab9b0f029f963ee0d5377e6de9c2f8443bb9","source":"amazon-inspector","versions":["0.0.0-stage"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}