cs-core-api-phoenix

{"modified":"2026-10-26T00:00:00Z","published":"2026-10-26T00:00:00Z","schema_version":"1.7.4","id":"MAL-2026-18686","summary":"Malicious code in cs-core-api-phoenix (npm)","details":"cs-core-api-phoenix 5.1.0 is a dependency-confusion package: its postinstall script reads the OS user name and hostname and POSTs them to https://nathanaccacio.com/collect on every install. It targets an internal-looking name and collects data from whoever installs it, without consent.","affected":[{"package":{"ecosystem":"npm","name":"cs-core-api-phoenix"},"versions":["5.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cs-core-api-phoenix"}],"credits":[{"name":"CyberXYZ","type":"FINDER","contact":["https://cyberxyz.io"]}],"database_specific":{"iocs":{"domains":["nathanaccacio.com"],"files":[{"digests":{"sha256":"310147b5035c63078181fa858763852cf40cde75c8a1439428aab8f10510d898"},"paths":["index.js"]},{"digests":{"sha256":"f351b64f04f8cbc6ff1480d76c77b590ee5887b07f5675ec9cca7e1ca856c6ac"},"paths":["regex-linter-poc/index.js"]}],"ips":[],"urls":["https://nathanaccacio.com/collect"]}}}