{
 "affected": [
  {
   "package": {
    "ecosystem": "npm",
    "name": "@azure-growth/signup-ux-components"
   },
   "versions": [
    "2.9.9"
   ]
  }
 ],
 "aliases": [
  "MAL-2026-18338"
 ],
 "credits": [
  {
   "contact": [
    "https://protet.io/intel/npm/@azure-growth/signup-ux-components/2.9.9"
   ],
   "name": "Protet",
   "type": "FINDER"
  }
 ],
 "details": "@azure-growth/signup-ux-components 1.2.2, 1.2.3 and 2.9.9 are dependency-confusion packages that take the name of a package used internally by Microsoft's Azure signup site and not published on the npm registry; 2.9.9 carries a version number above the internal release, so resolvers that also check the public registry prefer it. Their `preinstall` script runs `node index.js`, which reads the OS username and hostname and sends them in a DNS lookup of `msrc-poc.<user>.<hostname>.dbg6vplohjpkmtolbi6g18ekofkxjzm4s.oast.fun`, an out-of-band interaction collector; `index.js` is also the package entry point, so the lookup repeats whenever the package is required. Any machine that installed one of these versions has disclosed its username and hostname to a third party. The earlier `0.0.0-stage` version is an inert placeholder and is not affected.",
 "id": "PROTET-NPM-2026-124",
 "modified": "2026-10-28T12:29:02Z",
 "published": "2026-10-27T12:19:01Z",
 "references": [
  {
   "type": "REPORT",
   "url": "https://protet.io/intel/npm/@azure-growth/signup-ux-components/2.9.9"
  }
 ],
 "schema_version": "1.6.0",
 "summary": "Dependency-confusion package sends the username and hostname via DNS to an oast.fun collector"
}