@mobile-platform/magnetic-components 0.0.3

Details

@mobile-platform/magnetic-components 0.0.3 contains only a placeholder index.js and a preinstall script (node preinstall.js). At install time the script performs a DNS lookup of mobile-shared-poc.dbhmeq71af5395un3p70tujr84cuwuyg7.oast.me, an out-of-band interaction host, ignoring the result, and prints a message. The package description says it claims a scoped name referenced by a third-party mobile app, published for a bug bounty submission. The lookup is static and carries no host data, but it tells the publisher that, and from which network resolver, the package was installed; the publisher can change the install script in a later version. Versions 0.0.1 and 0.0.2 were published the same day with the same preinstall hook. Impact: installing the package signals the installing organisation DNS infrastructure to a third party, and the name can be used for dependency confusion against projects that expect the private package. Remediation: remove the package, install with --ignore-scripts where possible, pin the scope to your private registry, and block oast.me on build hosts.