mal-2026-16477

{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "index.js",
              "sha256": "29dab8bc128d6a5323f474175e9eb6df68ba488480dbbf36c04dc4ef62e91f0b",
              "tlsh": "55e061f442d34b715f6047c05042244db54795757560e680f78942a45fd3db15931efc"
            }
          ],
          "package_integrity": [
            {
              "filename": "com.apple.unityplugin.storekit-1.0.2.tgz",
              "hashes": {
                "sha1": "bf63c5ce089c07285eccc7ae69e671bacca7f756",
                "sha512_sri": "sha512-+eN7chIlxd2xfgpoFJk2eqUFyHIXB5CsmF67Cg6JaYrhfeYkrkG7aUIfAwGxNG1N6BFMk/yfcmo1zQvJIZAvag=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "com.apple.unityplugin.storekit"
      },
      "versions": [
        "1.0.2"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-020491",
        "import_time": "2026-09-23T14:19:31.869628617Z",
        "modified_time": "2026-09-23T14:10:47Z",
        "sha256": "920277566757bdc38563c7e2150e906790478cbd7a0c48f0bb53004e82eec4ca",
        "source": "amazon-inspector",
        "versions": [
          "1.0.2"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (920277566757bdc38563c7e2150e906790478cbd7a0c48f0bb53004e82eec4ca)\nThe package impersonates an Apple/Unity StoreKit internal namespace (com.apple.unityplugin.storekit) and, on require(), index.js performs an HTTPS GET to a hardcoded Project Discovery Interactsh (oast.fun) subdomain, transmitting the package name, os.platform(), and os.hostname() as query parameters (target: https://dapnhid534ch06s9vpm0mbg1httu5gytc.oast.fun). The behavior is unconditional, undocumented, and fires at module load with no caller opt-in. The name/scope, the author claim of 'Apple, Inc', and the OAST callback destination are the standard dependency-confusion reconnaissance shape: the beacon confirms that an internal build system has resolved the attacker's public package instead of Apple's private one, and leaks the internal hostname of the machine that resolved it.\n",
  "id": "MAL-2026-16477",
  "modified": "2026-09-23T14:10:47Z",
  "published": "2026-09-23T14:10:47Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/com.apple.unityplugin.storekit/v/1.0.2"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in com.apple.unityplugin.storekit (npm)"
}