MAL-2026-13970

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (a1b33c04eb2fb12d521b76353993517475d9239c9790c085d16c0c3d0a4ba2f9) Package @hzero-front-ui/hzero-ui@99.99.99 is a scope-lookalike of @hzero-front/hzero-ui with a placeholder version, empty author, generic description, and a trivial index.js. Its package.json preinstall and install lifecycle scripts base64-encode $(whoami):$(hostname):$(pwd):$npm_package_name and send the encoded value to attacker-controlled subdomains of callback.m0chan.co.uk over both HTTPS (curl) and DNS (nslookup). This fires automatically on `npm install`, leaking the installer's OS username, hostname, current working directory, and the internal package name that resolved to this lure — the canonical dependency-confusion beacon shape.