Dependency-confusion PoC package: @mobile-platform/magnetic-components (npm) — preinstall script runs on install, phones home via DNS
Severity: medium · Patch status: no-fix-needed · Since 2026-11-02
A dependency-confusion package, @mobile-platform/magnetic-components, was published to npm by account io-8 on 2026-10-29 in versions 0.0.1–0.0.3. The scoped name reportedly appears in the Meraki Dashboard Android app's bundled JavaScript but was unclaimed on the public registry, so any build resolving the scope from npm executes the attacker's preinstall script (node preinstall.js) with the installing user's privileges. Versions 0.0.1–0.0.2 drop a DEPENDENCYCONFUSIONPOCMARKER.txt file; 0.0.3 performs a DNS lookup of a fixed subdomain of an interactsh callback host (oast.me) to signal installation. No host data beyond the DNS lookup is sent, and no patched versions exist — the package is malware and should be removed, not upgraded. Flagged by OpenSSF and published to the GitHub Advisory Database (GHSA-q54x-hhg5-963x) on 2026-11-02.
What to do
- Audit npm install logs and CI systems for any install of @mobile-platform/magnetic-components since 2026-10-29; treat affected build hosts as compromised pending review
- Check for DEPENDENCY_CONFUSION_POC_MARKER.txt files and DNS/interactsh callbacks to *.oast.me subdomains
- Remove/block the package and pin the @mobile-platform scope to the private registry
- Configure .npmrc with a private registry mapping for the @mobile-platform scope and enable registry allow-lists to prevent future dependency confusion
- Rotate any credentials accessible from affected CI/build environments if compromise is confirmed
Sources
All live incidents on Threat Watch
