Live › package › MAL-2026-18433
Not triaged yet. The sources’ own description is below.
First seen by InfraStack 2026-11-01 09:19 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| @axon-web/icons | npm | = 99.0.0 | – |
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
-= Per source details. Do not edit below this line.=-
On require, index.js constructs an identifier from os.hostname() and process.env.USER/USERNAME and issues a DNS resolve against a subdomain of nxsqlpejfpamagxctjyv4c9qj1gfdtzwi.oast.fun — an interactsh/OAST out-of-band collector — leaking the installer's hostname and OS username to an attacker-controlled DNS server as a side effect of module load. The same file enumerates process.env keys matching /token|secret|key|pass|aws|github|npm/i and writes the matching key names to stdout, which is reconnaissance of credential-bearing environment variables. The package presents as an icons library at version 99.0.0 with no icon content, consistent with a dependency-confusion or typosquat payload rather than a legitimate library.
This page as .md · .json · in your agent: get_signal("MAL-2026-18433")