{"items":[{"id":"NVI-00008679","kind":"supply_chain_event","title":"Malicious code in @ppa-web-components/ppa-hotel-collection (npm)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-g7m6-g9fm-57wh"],"plain_summary":"GitHub lists this malware advisory for @ppa-web-components/ppa-hotel-collection, @ppa-web-components/ppa-hotel-collection, @ppa-web-components/ppa-hotel-collection, @ppa-web-components/ppa-hotel-collection, @ppa-web-components/ppa-hotel-collection. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-a8ef8e56ed3351fcdba898c2ae7a33f5"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-a8ef8e56ed3351fcdba898c2ae7a33f5","url":"https://github.com/advisories/GHSA-g7m6-g9fm-57wh","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-g7m6-g9fm-57wh","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:59.340Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-a8ef8e56ed3351fcdba898c2ae7a33f5"],"technology":"@ppa-web-components/ppa-hotel-collection","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (e442008a433c1edbe8fb25f9b47dd3123f5664672c3901167fc9d3add8a6bd6e)\n@ppa-web-components/ppa-hotel-collection@1.1.0 is a stub package whose only functional code is a callback beacon. The package.json declares scripts.postinstall: \"node beacon.cjs\", and the same beacon.cjs is also triggered via the main entry on require(). beacon.cjs collects os.hostname(), __dirname, process.cwd(), and process.version/npm version and POSTs them to the hardcoded bare-IP URL http://185.158.107.175:8787/_ah/dc over cleartext HTTP. The destination is unrelated to any legitimate publisher infrastructure for the @ppa-web-components scope. The package's only export is a no-op Proxy, and the description self-labels as \"Compatibility shim.\" with internal comments noting that a build which \"completes and calls back is cleaner evidence\" — consistent with a dependency-confusion probe targeting an internal @ppa-web-components namespace. Installing or requiring the package automatically exfiltrates host and path identifiers to attacker-controlled infrastructure, marking the installer's build system as reachable for follow-on targeting.\n\n---\n\nCredit: [OpenSSF](https://github.com/ossf/mal","public_affected_ranges":["= 99.0.1"]},{"certainty":"source_listed","source_ids":["sr-a8ef8e56ed3351fcdba898c2ae7a33f5"],"technology":"@ppa-web-components/ppa-hotel-collection","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (e442008a433c1edbe8fb25f9b47dd3123f5664672c3901167fc9d3add8a6bd6e)\n@ppa-web-components/ppa-hotel-collection@1.1.0 is a stub package whose only functional code is a callback beacon. The package.json declares scripts.postinstall: \"node beacon.cjs\", and the same beacon.cjs is also triggered via the main entry on require(). beacon.cjs collects os.hostname(), __dirname, process.cwd(), and process.version/npm version and POSTs them to the hardcoded bare-IP URL http://185.158.107.175:8787/_ah/dc over cleartext HTTP. The destination is unrelated to any legitimate publisher infrastructure for the @ppa-web-components scope. The package's only export is a no-op Proxy, and the description self-labels as \"Compatibility shim.\" with internal comments noting that a build which \"completes and calls back is cleaner evidence\" — consistent with a dependency-confusion probe targeting an internal @ppa-web-components namespace. Installing or requiring the package automatically exfiltrates host and path identifiers to attacker-controlled infrastructure, marking the installer's build system as reachable for follow-on targeting.\n\n---\n\nCredit: [OpenSSF](https://github.com/ossf/mal","public_affected_ranges":["= 1.1.0"]},{"certainty":"source_listed","source_ids":["sr-a8ef8e56ed3351fcdba898c2ae7a33f5"],"technology":"@ppa-web-components/ppa-hotel-collection","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (e442008a433c1edbe8fb25f9b47dd3123f5664672c3901167fc9d3add8a6bd6e)\n@ppa-web-components/ppa-hotel-collection@1.1.0 is a stub package whose only functional code is a callback beacon. The package.json declares scripts.postinstall: \"node beacon.cjs\", and the same beacon.cjs is also triggered via the main entry on require(). beacon.cjs collects os.hostname(), __dirname, process.cwd(), and process.version/npm version and POSTs them to the hardcoded bare-IP URL http://185.158.107.175:8787/_ah/dc over cleartext HTTP. The destination is unrelated to any legitimate publisher infrastructure for the @ppa-web-components scope. The package's only export is a no-op Proxy, and the description self-labels as \"Compatibility shim.\" with internal comments noting that a build which \"completes and calls back is cleaner evidence\" — consistent with a dependency-confusion probe targeting an internal @ppa-web-components namespace. Installing or requiring the package automatically exfiltrates host and path identifiers to attacker-controlled infrastructure, marking the installer's build system as reachable for follow-on targeting.\n\n---\n\nCredit: [OpenSSF](https://github.com/ossf/mal","public_affected_ranges":["= 3.0.0"]},{"certainty":"source_listed","source_ids":["sr-a8ef8e56ed3351fcdba898c2ae7a33f5"],"technology":"@ppa-web-components/ppa-hotel-collection","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (e442008a433c1edbe8fb25f9b47dd3123f5664672c3901167fc9d3add8a6bd6e)\n@ppa-web-components/ppa-hotel-collection@1.1.0 is a stub package whose only functional code is a callback beacon. The package.json declares scripts.postinstall: \"node beacon.cjs\", and the same beacon.cjs is also triggered via the main entry on require(). beacon.cjs collects os.hostname(), __dirname, process.cwd(), and process.version/npm version and POSTs them to the hardcoded bare-IP URL http://185.158.107.175:8787/_ah/dc over cleartext HTTP. The destination is unrelated to any legitimate publisher infrastructure for the @ppa-web-components scope. The package's only export is a no-op Proxy, and the description self-labels as \"Compatibility shim.\" with internal comments noting that a build which \"completes and calls back is cleaner evidence\" — consistent with a dependency-confusion probe targeting an internal @ppa-web-components namespace. Installing or requiring the package automatically exfiltrates host and path identifiers to attacker-controlled infrastructure, marking the installer's build system as reachable for follow-on targeting.\n\n---\n\nCredit: [OpenSSF](https://github.com/ossf/mal","public_affected_ranges":["= 1.0.0"]},{"certainty":"source_listed","source_ids":["sr-a8ef8e56ed3351fcdba898c2ae7a33f5"],"technology":"@ppa-web-components/ppa-hotel-collection","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (e442008a433c1edbe8fb25f9b47dd3123f5664672c3901167fc9d3add8a6bd6e)\n@ppa-web-components/ppa-hotel-collection@1.1.0 is a stub package whose only functional code is a callback beacon. The package.json declares scripts.postinstall: \"node beacon.cjs\", and the same beacon.cjs is also triggered via the main entry on require(). beacon.cjs collects os.hostname(), __dirname, process.cwd(), and process.version/npm version and POSTs them to the hardcoded bare-IP URL http://185.158.107.175:8787/_ah/dc over cleartext HTTP. The destination is unrelated to any legitimate publisher infrastructure for the @ppa-web-components scope. The package's only export is a no-op Proxy, and the description self-labels as \"Compatibility shim.\" with internal comments noting that a build which \"completes and calls back is cleaner evidence\" — consistent with a dependency-confusion probe targeting an internal @ppa-web-components namespace. Installing or requiring the package automatically exfiltrates host and path identifiers to attacker-controlled infrastructure, marking the installer's build system as reachable for follow-on targeting.\n\n---\n\nCredit: [OpenSSF](https://github.com/ossf/mal","public_affected_ranges":["= 2.0.1"]}],"null_published_at":"2026-10-31T22:13:27.106Z","source_updated_at":"2026-10-26T03:31:41.000Z","source_disclosed_at":"2026-10-25T15:31:38.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:56:59.340Z"}],"next_cursor":null,"snapshot_revision":"42594"}