{
 "affected": [
  {
   "package": {
    "ecosystem": "npm",
    "name": "@mobile-platform/magnetic-components"
   },
   "versions": [
    "0.0.3"
   ]
  }
 ],
 "aliases": [],
 "credits": [
  {
   "contact": [
    "https://protet.io/intel/npm/@mobile-platform/magnetic-components/0.0.3"
   ],
   "name": "Protet",
   "type": "FINDER"
  }
 ],
 "details": "@mobile-platform/magnetic-components 0.0.3 contains only a placeholder index.js and a preinstall script (`node preinstall.js`). At install time the script performs a DNS lookup of mobile-shared-poc.dbhmeq71af5395un3p70tujr84cuwuyg7.oast.me, an out-of-band interaction host, ignoring the result, and prints a message. The package description says it claims a scoped name referenced by a third-party mobile app, published for a bug bounty submission. The lookup is static and carries no host data, but it tells the publisher that, and from which network resolver, the package was installed; the publisher can change the install script in a later version. Versions 0.0.1 and 0.0.2 were published the same day with the same preinstall hook. Impact: installing the package signals the installing organisation DNS infrastructure to a third party, and the name can be used for dependency confusion against projects that expect the private package. Remediation: remove the package, install with --ignore-scripts where possible, pin the scope to your private registry, and block oast.me on build hosts.",
 "id": "PROTET-NPM-2026-157",
 "modified": "2026-11-01T11:59:01Z",
 "published": "2026-11-01T11:59:01Z",
 "references": [
  {
   "type": "REPORT",
   "url": "https://protet.io/intel/npm/@mobile-platform/magnetic-components/0.0.3"
  }
 ],
 "schema_version": "1.6.0",
 "summary": "Install script resolves an oast.me out-of-band host to confirm the package was installed"
}