{
 "affected": [
  {
   "package": {
    "ecosystem": "npm",
    "name": "@ppa-web-components/ppa-builder"
   },
   "versions": [
    "0.0.1"
   ]
  }
 ],
 "aliases": [
  "MAL-2026-18273"
 ],
 "credits": [
  {
   "contact": [
    "https://protet.io/intel/npm/@ppa-web-components/ppa-builder/0.0.1"
   ],
   "name": "Protet",
   "type": "FINDER"
  }
 ],
 "details": "@ppa-web-components/ppa-builder 0.0.1 is published under a name that matches a private internal package scope, at artificially high or unusual versions, so that build systems resolving the internal name from the public registry install it instead. Its package.json runs `node beacon.cjs` as a postinstall script. The script sends an HTTP POST to http://185.158.107.175:8787/_ah/dc with the package name, the machine's hostname, the install directory, the current working directory and the Node.js version, tagged with an x-beacon-package header. The package's entry point sends the same request again whenever it is loaded, and otherwise exports an empty stub, so the package has no legitimate functionality. Impact: any developer or CI machine that installs it discloses its hostname and filesystem layout to a third party, and confirms that the internal package name resolves from the public registry, which enables follow-up attacks with a harmful payload. Remediation: remove the package, scope internal package names to a private registry (or pin the scope to it), install with --ignore-scripts where possible, and block 185.158.107.175 on build hosts.",
 "id": "PROTET-NPM-2026-107",
 "modified": "2026-10-25T21:19:01Z",
 "published": "2026-10-25T15:19:01Z",
 "references": [
  {
   "type": "REPORT",
   "url": "https://protet.io/intel/npm/@ppa-web-components/ppa-builder/0.0.1"
  }
 ],
 "schema_version": "1.6.0",
 "summary": "Dependency-confusion package sends hostname and install paths to a remote server at install time"
}