🛡️ MAL-2026-3653 — web

Malicious code in @design-system-coopeuch/web (npm)

Source: amazon-inspector

Package @design-system-coopeuch/[email protected] is a dependency-confusion squat of an internal-looking scope, published at an inflated 999.x version to override any private registry copy. package.json declares a preinstall hook that runs cb.js, which collects installer host identifiers (os.hostname(), cwd, install directory, id, uname -a, OS release info, and the full list of process.env key names) and POSTs them as JSON over cleartext HTTP to a hardcoded bare IP, http://157.173.126.113:8443/dep-confusion (cb.js line 20: hostname: "157.173.126.113", port: 8443, path: "/dep-confusion", method: "POST"). The beacon fires automatically on npm install without user consent. Although the package description self-labels as an "authorized bug bounty PoC," any unintended installer has their host fingerprint exfiltrated to an attacker-controlled endpoint. The combination of internal-scope impersonation, inflated version, and install-time beacon to a bare IP is the canonical dependency-confusion attack shape.

Source: ossf-package-analysis

The OpenSSF Package Analysis project identified '@design-system-coopeuch/web' @ 999.0.0 (npm) as malicious.

It is considered malicious because:

• The package executes one or more commands associated with malicious behavior.