Dependency-confusion malware: @zmtcdn/components and @zmtcdn/ui npm packages exfiltrate host data via postinstall script
Severity: critical · Patch status: no-fix-needed · Since 2026-10-29
Two dependency-confusion packages published by npm account killshs — @zmtcdn/components@9999.0.0 and @zmtcdn/ui@9999.0.0 and 9999.0.7 — contain empty index.js files described as 'Security research PoC' but run node postinstall.js on npm install. The postinstall script POSTs the hostname, username, platform, working directory and the names of all environment variables to attacker-controlled endpoints (webhook.site for @zmtcdn/components, www.hinny.shop/api for @zmtcdn/ui). Any developer or CI system that installs these packages leaks host metadata and environment variable names, which can guide follow-on attacks. Flagged by OpenSSF and published to the GitHub Advisory Database on 2026-10-29 as malware (CWE-506). No patched versions exist; the only fix is to never install these packages and remove them if present.
What to do
- Search lockfiles, CI caches and installed node_modules for @zmtcdn/components and @zmtcdn/ui and remove them; treat any machine that installed them as potentially compromised
- Rotate secrets and review environment variables on affected build machines, since env var names were exfiltrated
- Block the packages and the exfiltration endpoints (webhook.site/f52af355-4783-4acb-9de1-5e44b5963025, www.hinny.shop) at proxy/firewall level
- Configure npm scoped-registry mappings and internal registry placeholders to prevent dependency confusion for internal @zmtcdn scope
- Audit npm install logs and enable ignore-scripts or allowlisted postinstall policies in CI
Sources
All live incidents on Threat Watch
