Is template-projection-map malicious?
Yes. Protet confirmed 2 versions of template-projection-map as malicious
First confirmed on 2026-11-07.
Affected versions
| Version | Confirmed | Protet record |
|---|---|---|
| 99.1.3 | 2026-11-07 | PROTET-NPM-2026-164 |
| 22.1.1 | 2026-11-07 | PROTET-NPM-2026-161 |
What it does
A dependency-confusion package published 2026-11-07 under the unscoped name template-projection-map with version 99.1.3 to win resolution over a private package of the same name. Its postinstall hook runs 'node beacon.cjs', which sends the package name, the machine's hostname, the current working directory and the install path by HTTP POST over cleartext to the hardcoded endpoint http://13.140.137.222:8787/_ah/dc; the package entry point sends the same request again whenever the package is loaded with require. The same actor and endpoint as MAL-2026-18356. Self-described as an authorized dependency-confusion test. Remove the package and treat the hostnames and paths of affected build machines as disclosed.
Other reports
- Also reported in OSV as MAL-2026-18802
What to do if you installed it
- Remove the package from every project that uses it, directly or through another dependency.
- Pin a clean version if you need the package: one that is not listed above and that you have checked yourself, or replace the package. A version missing from this page is not cleared.
- Check your lockfiles (
package-lock.json,yarn.lock,pnpm-lock.yaml) for the affected versions, including as a transitive dependency, and in CI caches. - Rotate credentials that were reachable from any machine or build that installed it: npm and GitHub tokens, cloud keys, SSH keys, and secrets in environment variables or CI settings.
Status history
- 2026-11-07: 22.1.1, 99.1.3 named by Protet Intel