{"id":"MAL-2026-18356","kind":"package","aliases":["MAL-2026-18356"],"related":[],"title":"Malicious code in @webapp-shared/login-vmok (npm)","description":"@webapp-shared/login-vmok is a dependency-confusion package: it uses the `@webapp-shared` scope, which matches a private internal package scope, and was published on 2026-10-27 in versions 1.0.0, 1.0.1, 1.1.0, 2.0.1, 3.0.0 and 99.0.1 so that builds resolving the internal name from the public registry install it instead. Its `postinstall` script runs `node beacon.cjs`, which sends an HTTP POST over cleartext HTTP to the hardcoded IP endpoint `http://13.140.137.222:8787/_ah/dc` with the package name, the machine's hostname, the install directory, the current working directory and the Node.js version; the entry point `index.js` sends the same request again whenever the package is loaded and otherwise has no functionality. The beacon code is the same as in other dependency-confusion packages sending to `http://185.158.107.175:8787/_ah/dc` (e.g. MAL-2026-18276), with only the endpoint and package name changed. The inert `0.0.0-stage` and `0.1.0` placeholder versions carry no install script and are not affected. Any machine that installed an affected version has disclosed its hostname and filesystem layout to a third party; remove the package, pin or scope internal package names to the internal registry, and block 13.140.137.222 on build hosts.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@webapp-shared/login-vmok","fixed":[],"affected":"= 1.0.0; = 1.0.1; = 1.1.0; = 2.0.1; = 3.0.0; = 99.0.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-27T17:08:01+00:00","first_seen_at":"2026-10-28T07:01:41+00:00","triaged_at":"2026-10-28T07:03:38+00:00","updated_at":"2026-10-28T07:07:01+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-10':50C '-18276':154C '-18356':11A,14A '-2026':10A,13A,153C '-27':51C '/login-vmok':7A,18A,24C '0.0.0':165C '0.1.0':168C '1.0.0':54C '1.0.1':55C '1.1.0':56C '13.140.137.222':94C,212C '185.158.107.175':149C '2.0.1':57C '2026':49C '3.0.0':58C '8787/_ah/dc':95C,150C '99.0.1':60C 'affect':178C,184C 'beacon':135C 'beacon.cjs':80C 'block':211C 'build':63C,214C 'carri':171C 'chang':162C 'cleartext':87C 'code':2A,136C 'confus':29C,145C 'current':108C 'depend':28C,144C 'dependency-confus':27C,143C 'directori':106C,110C 'disclos':187C 'e.g':151C 'endpoint':93C,158C 'entri':116C 'filesystem':191C 'function':133C 'hardcod':91C 'host':215C 'hostnam':103C,189C 'http':84C,88C 'index.js':118C 'inert':164C 'instal':72C,105C,173C,182C 'instead':74C 'intern':42C,66C,203C,208C 'ip':92C 'layout':192C 'load':128C 'machin':101C,180C 'mal':9A,12A,152C 'malici':1A,19B 'match':39C 'name':67C,99C,161C,205C 'node':79C 'node.js':113C 'npm':8A 'otherwis':130C 'packag':20B,30C,43C,98C,126C,146C,160C,199C,204C 'parti':196C 'pin':200C 'placehold':169C 'point':117C 'post':85C 'postinstal':76C 'privat':41C 'public':70C 'publish':47C 'registri':71C,209C 'remov':197C 'request':122C 'resolv':64C 'run':78C 'scope':37C,44C,202C 'script':77C,174C 'send':82C,119C,147C 'share':6A,23C,36C 'shared':17A 'stage':166C 'third':195C 'use':32C 'version':53C,114C,170C,185C 'webapp':5A,16A,22C,35C 'webapp-shar':4A,21C,34C 'webapp-shared':15A 'whenev':124C 'work':109C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:08:01+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18356","url":"https://osv.dev/vulnerability/MAL-2026-18356","severity":"critical","published_at":"2026-10-27T17:08:01+00:00","modified_at":"2026-10-28T06:30:05+00:00","first_seen_at":"2026-10-28T07:01:41+00:00","fetched_at":"2026-10-28T07:01:41+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}