Is @mobile-platform/magnetic-components malicious?
Yes. Protet confirmed 1 version of @mobile-platform/magnetic-components as malicious
First confirmed on 2026-11-01.
Affected versions
| Version | Confirmed | Protet record |
|---|---|---|
| 0.0.3 | 2026-11-01 | PROTET-NPM-2026-157 |
What it does
Install script resolves an oast.me out-of-band host to confirm the package was installed
@mobile-platform/magnetic-components 0.0.3 contains only a placeholder index.js and a preinstall script (node preinstall.js). At install time the script performs a DNS lookup of mobile-shared-poc.dbhmeq71af5395un3p70tujr84cuwuyg7.oast.me, an out-of-band interaction host, ignoring the result, and prints a message. The package description says it claims a scoped name referenced by a third-party mobile app, published for a bug bounty submission. The lookup is static and carries no host data, but it tells the publisher that, and from which network resolver, the package was installed; the publisher can change the install script in a later version. Versions 0.0.1 and 0.0.2 were published the same day with the same preinstall hook. Impact: installing the package signals the installing organisation DNS infrastructure to a third party, and the name can be used for dependency confusion against projects that expect the private package. Remediation: remove the package, install with --ignore-scripts where possible, pin the scope to your private registry, and block oast.me on build hosts.
Indicators
Domainsmobile-shared-poc.dbhmeq71af5395un3p70tujr84cuwuyg7.oast.me
What to do if you installed it
- Remove the package from every project that uses it, directly or through another dependency.
- Pin a clean version if you need the package: one that is not listed above and that you have checked yourself, or replace the package. A version missing from this page is not cleared.
- Check your lockfiles (
package-lock.json,yarn.lock,pnpm-lock.yaml) for the affected versions, including as a transitive dependency, and in CI caches. - Rotate credentials that were reachable from any machine or build that installed it: npm and GitHub tokens, cloud keys, SSH keys, and secrets in environment variables or CI settings.
Status history
- 2026-11-01: 0.0.3 named by Protet Intel