{"id":"MAL-2026-18448","kind":"package","aliases":["MAL-2026-18448"],"related":[],"title":"Malicious code in @mobile-platform/magnetic-components (npm)","description":"@mobile-platform/magnetic-components is a dependency-confusion package: its description says the scoped name is referenced in the Meraki Dashboard Android app's bundled JavaScript and was unclaimed on the public registry, so a build that resolves `@mobile-platform` from npm runs its code instead of the intended private package. Its preinstall script runs `node preinstall.js` on npm install; in 0.0.1 and 0.0.2 it writes `DEPENDENCY_CONFUSION_POC_MARKER.txt` into the working directory, and in 0.0.3 it makes a DNS lookup of a fixed subdomain of `dbhmeq71af5395un3p70tujr84cuwuyg7.oast.me`, an interactsh callback host, signalling that the package was installed. It sends no host data beyond the lookup itself, but unreviewed code from an outside publisher has run with the installing user's privileges. The npm account io-8 published the three versions on 2026-10-29.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@mobile-platform/magnetic-components","fixed":[],"affected":"= 0.0.1; = 0.0.2; = 0.0.3","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-29T15:19:02+00:00","first_seen_at":"2026-11-02T06:51:32+00:00","triaged_at":"2026-11-02T06:53:12+00:00","updated_at":"2026-11-02T06:53:35+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-10':153C '-18448':11A,14A '-2026':10A,13A '-29':154C '-8':146C '/magnetic-components':7A,18A,24C '0.0.1':84C '0.0.2':86C '0.0.3':96C '2026':152C 'account':144C 'android':43C 'app':44C 'beyond':123C 'build':57C 'bundl':46C 'callback':110C 'code':2A,67C,129C 'confus':29C 'dashboard':42C 'data':122C 'dbhmeq71af5395un3p70tujr84cuwuyg7.oast.me':107C 'depend':28C 'dependency-confus':27C 'dependency_confusion_poc_marker.txt':89C 'descript':32C 'directori':93C 'dns':100C 'fix':104C 'host':111C,121C 'instal':82C,117C,138C 'instead':68C 'intend':71C 'interactsh':109C 'io':145C 'javascript':47C 'lookup':101C,125C 'make':98C 'mal':9A,12A 'malici':1A,19B 'meraki':41C 'mobil':5A,22C,61C 'mobile':16A 'mobile-platform':4A,15A,21C,60C 'name':36C 'node':78C 'npm':8A,64C,81C,143C 'outsid':132C 'packag':20B,30C,73C,115C 'platform':6A,17A,23C,62C 'preinstal':75C 'preinstall.js':79C 'privat':72C 'privileg':141C 'public':53C 'publish':133C,147C 'referenc':38C 'registri':54C 'resolv':59C 'run':65C,77C,135C 'say':33C 'scope':35C 'script':76C 'send':119C 'signal':112C 'subdomain':105C 'three':149C 'unclaim':50C 'unreview':128C 'user':139C 'version':150C 'work':92C 'write':88C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["magneticcomponents"],"ptokens":["components","magnetic","mobile","platform"],"labels":["critical","malicious","npm","package"],"first_public_at":"2026-10-29T15:19:02+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18448","url":"https://osv.dev/vulnerability/MAL-2026-18448","severity":"critical","published_at":"2026-10-29T15:19:02+00:00","modified_at":"2026-11-02T05:30:05+00:00","first_seen_at":"2026-11-02T06:51:32+00:00","fetched_at":"2026-11-02T06:51:32+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}