{"id":"MAL-2026-18686","kind":"package","aliases":["MAL-2026-18686"],"related":[],"title":"Malicious code in cs-core-api-phoenix (npm)","description":"cs-core-api-phoenix 5.1.0 is a dependency-confusion package: its postinstall script reads the OS user name and hostname and POSTs them to https://nathanaccacio.com/collect on every install. It targets an internal-looking name and collects data from whoever installs it, without consent.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"cs-core-api-phoenix","fixed":[],"affected":"= 5.1.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-26T00:00:00+00:00","first_seen_at":"2026-11-05T06:31:45+00:00","triaged_at":"2026-11-05T06:32:52+00:00","updated_at":"2026-11-05T06:32:52+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-18686':12A,15A '-2026':11A,14A '/collect':51C '5.1.0':28C 'api':7A,19A,26C 'code':2A 'collect':63C 'confus':33C 'consent':70C 'core':6A,18A,25C 'cs':5A,17A,24C 'cs-core-api-phoenix':4A,16A,23C 'data':64C 'depend':32C 'dependency-confus':31C 'everi':53C 'hostnam':44C 'instal':54C,67C 'intern':59C 'internal-look':58C 'look':60C 'mal':10A,13A 'malici':1A,21B 'name':42C,61C 'nathanaccacio.com':50C 'nathanaccacio.com/collect':49C 'npm':9A 'os':40C 'packag':22B,34C 'phoenix':8A,20A,27C 'post':46C 'postinstal':36C 'read':38C 'script':37C 'target':56C 'user':41C 'whoever':66C 'without':69C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["cscoreapiphoenix"],"ptokens":["api","core","cs","phoenix"],"labels":["critical","malicious","npm","package"],"campaign_type":null,"first_public_at":"2026-10-26T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18686","url":"https://osv.dev/vulnerability/MAL-2026-18686","severity":"critical","published_at":"2026-10-26T00:00:00+00:00","modified_at":"2026-11-05T05:15:04+00:00","first_seen_at":"2026-11-05T06:31:45+00:00","fetched_at":"2026-11-05T06:31:45+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}