Malware in @ppa-web-components/ppa-navigation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @ppa-web-components/ppa-builder

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @ppa-web-components/ppa-banner

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @ppa-web-components/ppa-headerfooter

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @ppa-web-components/ppa-hotel-collection

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @ppa-web-components/ppa-searchform

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @ppa-web-components/ppa-headerfooter (npm)

Source: amazon-inspector 32234bc8ba0c918d154d680b15a1bcb7ae6f6b7d20365c02095842b84e245dce The package ships a beacon.cjs script wired as both the postinstall lifecycle hook node beacon.cjs and a require-time side effect from index.js. On install and on require, the beacon POSTs installer...

Malicious code in @ppa-web-components/ppa-hotel-collection (npm)

Source: amazon-inspector e442008a433c1edbe8fb25f9b47dd3123f5664672c3901167fc9d3add8a6bd6e @ppa-web-components/[email protected] is a stub package whose only functional code is a callback beacon. The package.json declares scripts.postinstall: "node beacon.cjs", and the same beacon.cjs is...

Malicious code in @ppa-web-components/ppa-searchform (npm)

Source: amazon-inspector c9b929e77e53b5f528d874024d0cf8cfe4a0e34845796964600b0e1511e6a49c The package ships a beacon.cjs that is wired to run both via the postinstall lifecycle script and from top-level index.js on require. On execution it collects host identifiers hostname, install path, current...

Malicious code in @ppa-web-components/ppa-builder (npm)

Source: amazon-inspector cc4615498b50aa4b5f39a8367c44e6a18d4a7272ae71235716a152b2933d5ddd The package is described as a 'Compatibility shim' and ships a stub Proxy-based main plus beacon.cjs. The package.json declares scripts.postinstall: 'node beacon.cjs', and the main entry also invokes the sam...

Malicious code in @ppa-web-components/ppa-navigation (npm)

Source: amazon-inspector c88c344e72bb7cf5ae6f5e6185a1024caf8b96bce96584d448609ab78cd894af The package is a shim whose only functional payload is a beacon. package.json declares a postinstall that runs node beacon.cjs, and index.js additionally invokes require'./beacon.cjs'.fire on load, so the...

Malicious code in @ppa-web-components/ppa-banner (npm)

Source: amazon-inspector bcf0b03540a27943a2afcc26927ce7256d85328bc4fcbc2562f36a88ad75ce8d @ppa-web-components/[email protected] is described as a 'Compatibility shim' but ships only two code paths: a no-op Proxy as its main export, and beacon.cjs. beacon.cjs defines BEACON =...

MAL-2026-18274 Malicious code in @ppa-web-components/ppa-headerfooter (npm)

@ppa-web-components/ppa-headerfooter is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 1.0.0, 2.0.1, 2.0.0, 1.0.1, 99.0.1, 3.0.0 has a postinstall scri...

Malicious code in @ppa-web-components/ppa-headerfooter (npm)

@ppa-web-components/ppa-headerfooter is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 1.0.0, 2.0.1, 2.0.0, 1.0.1, 99.0.1, 3.0.0 has a postinstall scri...

MAL-2026-18275 Malicious code in @ppa-web-components/ppa-hotel-collection (npm)

@ppa-web-components/ppa-hotel-collection is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 1.1.0, 1.0.0, 99.0.1, 2.0.1, 3.0.0 has a postinstall script...

Malicious code in @ppa-web-components/ppa-hotel-collection (npm)

@ppa-web-components/ppa-hotel-collection is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 1.1.0, 1.0.0, 99.0.1, 2.0.1, 3.0.0 has a postinstall script...

MAL-2026-18272 Malicious code in @ppa-web-components/ppa-banner (npm)

@ppa-web-components/ppa-banner is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 3.0.0, 1.0.1, 2.0.0, 1.1.0, 0.0.1, 2.0.1, 1.0.0 has a postinstall scri...

Malicious code in @ppa-web-components/ppa-banner (npm)

@ppa-web-components/ppa-banner is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 3.0.0, 1.0.1, 2.0.0, 1.1.0, 0.0.1, 2.0.1, 1.0.0 has a postinstall scri...

Malicious code in @ppa-web-components/ppa-builder (npm)

@ppa-web-components/ppa-builder is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 0.0.1, 1.0.0, 1.0.1, 99.0.1, 2.0.1, 3.0.0 has a postinstall script th...

MAL-2026-18273 Malicious code in @ppa-web-components/ppa-builder (npm)

@ppa-web-components/ppa-builder is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 0.0.1, 1.0.0, 1.0.1, 99.0.1, 2.0.1, 3.0.0 has a postinstall script th...