{"id":"MAL-2026-18372","kind":"package","aliases":["MAL-2026-18372"],"related":[],"title":"Malicious code in @zmtcdn/components (npm)","description":"@zmtcdn/components@9999.0.0 is a dependency-confusion package with an empty `index.js` and a description of \"Security research PoC\". Its postinstall script runs `node postinstall.js` on npm install, which POSTs the hostname, username, platform, working directory and the names of all environment variables to `https://webhook.site/f52af355-4783-4acb-9de1-5e44b5963025`. It was published by the npm account kill_shs, which also published @zmtcdn/ui with the same script.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@zmtcdn/components","fixed":[],"affected":"= 9999.0.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-28T09:59:37+00:00","first_seen_at":"2026-10-29T09:53:35+00:00","triaged_at":"2026-10-29T09:53:53+00:00","updated_at":"2026-10-29T09:56:48+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-18372':8A,11A '-2026':7A,10A '/f52af355-4783-4acb-9de1-5e44b5963025':61C '9999.0.0':16C 'account':68C 'also':72C 'code':2A 'confus':21C 'depend':20C 'dependency-confus':19C 'descript':29C 'directori':50C 'empti':25C 'environ':56C 'hostnam':46C 'index.js':26C 'instal':42C 'kill':69C 'mal':6A,9A 'malici':1A,13B 'name':53C 'node':38C 'npm':5A,41C,67C 'packag':14B,22C 'platform':48C 'poc':33C 'post':44C 'postinstal':35C 'postinstall.js':39C 'publish':64C,73C 'research':32C 'run':37C 'script':36C,78C 'secur':31C 'shs':70C 'usernam':47C 'variabl':57C 'webhook.site':60C 'webhook.site/f52af355-4783-4acb-9de1-5e44b5963025':59C 'work':49C 'zmtcdn/components':4A,12A,15C 'zmtcdn/ui':74C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-28T09:59:37+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18372","url":"https://osv.dev/vulnerability/MAL-2026-18372","severity":"critical","published_at":"2026-10-28T09:59:37+00:00","modified_at":"2026-10-29T09:15:04+00:00","first_seen_at":"2026-10-29T09:53:35+00:00","fetched_at":"2026-10-29T09:53:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}