Dependency-confusion beacon packages: mw-communication-client, mw-test-utils, mui-wrapper-x-date-pickers exfiltrate user/host/cwd on install
Severity: critical · Patch status: no-fix-needed · Since 2026-10-29
On 2026-10-27 the npm account amahrou1w published three near-identical packages — mw-communication-client, mw-test-utils and mui-wrapper-x-date-pickers — within eight minutes, each a dependency-confusion candidate for internal packages of the same company. Each tarball contains only an empty index.js, README and package.json, but declares preinstall and postinstall scripts that send the installing user's name, hostname and working directory over plain HTTP to IP 38.242.235.206. The README claims it is a bug-bounty dependency-confusion proof of concept, and static analysis (OpenSSF) confirms nothing beyond the two beacons executes. Anyone whose dependency resolution pulls these versions (1.0.x/10.0.x chosen to win loose ranges) leaks machine details. No patched versions exist; the packages are flagged malware in the GitHub Advisory Database.
What to do
- Search lockfiles and dependency trees for mw-communication-client, mw-test-utils and mui-wrapper-x-date-pickers and remove them
- Check proxy/egress logs for connections to 38.242.235.206 since 2026-10-27 and identify affected hosts and users
- Pin internal package names in private registries and configure scope/registry mapping to block dependency confusion
- Disable or audit install lifecycle scripts (npm config with ignore-scripts, --ignore-scripts in CI)
Sources
All live incidents on Threat Watch
