@axon-web/icons

{"schema_version":"1.7.4","id":"MAL-2026-18433","published":"2026-11-01T08:02:02Z","modified":"2026-11-02T02:18:16.579254100Z","summary":"Malicious code in @axon-web/icons (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ee650ff91eeb70cc76f880c6b66b586b21c471c95eac22a9e23160aaffa45a58)\nThe package is advertised as an SVG icon library but, on require, runs an IIFE that constructs an identifier from os.hostname() and process.env.USER/USERNAME and issues a DNS resolve against a subdomain of nxsqlpejfpamagxctjyv4c9qj1gfdtzwi.oast.fun — an interactsh-style out-of-band interaction collector. The hostname and username of the installing machine are leaked to a non-first-party DNS endpoint over outbound DNS, bypassing HTTP egress controls. The same import-time code enumerates process.env keys matching /token|secret|key|pass|aws|github|npm/i and prints the matching names alongside hostname, user, cwd, and Node version. No icon-library functionality justifies DNS beaconing or credential-name enumeration, and the host identity is sent to a destination the caller did not configure.\n","affected":[{"package":{"name":"@axon-web/icons","ecosystem":"npm"},"versions":["99.0.0","2.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"6b47accdd0db2d559cfbb7d2d3771112d710b39eb7930137868030007fdfb30b","tlsh":"b211ef8dd9fca37533a296c0b81904033abbef632581e420341c93965bd1a10832187d"}],"package_integrity":[{"filename":"icons-99.0.0.tgz","hashes":{"sha1":"9829db2d9cbc9401e75ffeb4902427763228774b","sha512_sri":"sha512-V4/eyUCjuDEFqijKoolkyHiIEHtE9Ht3EVdS9D86C6K+757BPwx05RBD42L9ynL8HWMVpqAcZ0QJScJbmMe+ew=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@axon-web/icons/v/99.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@axon-web/icons/v/2.0.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022474","import_time":"2026-11-01T08:14:47.534932062Z","modified_time":"2026-11-01T08:02:02Z","sha256":"579025dc4de76ecd9400215e99d550cb4579ab6eb7d78e4c3c91a2299ff59c91","source":"amazon-inspector","versions":["99.0.0"]},{"id":"IN-MAL-2026-022478","import_time":"2026-11-02T02:17:04.442512647Z","modified_time":"2026-11-02T01:45:30Z","sha256":"ee650ff91eeb70cc76f880c6b66b586b21c471c95eac22a9e23160aaffa45a58","source":"amazon-inspector","versions":["2.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}