MAL-2026-18373 Malicious code in @zmtcdn/ui (npm)

@zmtcdn/ui 9999.0.0 and 9999.0.7 are dependency-confusion packages with an empty index.js and a description of "Security research PoC". Their postinstall script runs node postinstall.js on npm install, which POSTs the hostname, username, platform, working directory and the names of all environment variables to https://www.hinny.shop/api. They were published by the npm account kill_shs, which also published @zmtcdn/components with the same script.

The postinstall.js lifecycle script runs automatically on npm install and collects installer-identifying data — os.hostname(), os.platform(), os.userInfo().username, process.cwd(), the list of process.env key names, and a timestamp — then POSTs the JSON blob via https.request to the hardcoded endpoint https://www.hinny.shop/api. The package name uses a vendor-style scope (@zmtcdn/ui) and an implausibly high version (9999.0.7) consistent with a dependency-confusion lure, and the fetch destination is unrelated to any declared publisher. No user opt-in, no documentation of the beacon, and no legitimate functional purpose for sending this data off-host at install time.