MAL-2026-14218
Malicious code in mapkit-loader (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (cb2d3c3e234b52b2bbffe7b197f9ec483b2b574667543338b975c99831633c86) Unscoped npm package 'mapkit-loader' impersonates the scoped '@apple/mapkit-loader' to intercept mistyped `npx mapkit-loader` invocations. The package.json self-describes as a 'PoC' targeting that confusion. On `npm install`, the postinstall lifecycle script (postinstall.js) unconditionally issues an HTTPS POST to a hardcoded third-party endpoint at npx-monitor-76056.azurewebsites.net/api/pingback carrying a persistent UUID, package version, trigger source ('npm-postinstall'), and timestamp. The UUID is written to ~/.cache/.mapkit-loader-id so subsequent executions (including the bin entry) can be correlated back to the same host. No credential or filesystem exfiltration is present, but the combination of name-confusion targeting an official Apple scope plus install-time beaconing to an author-controlled endpoint is a supply-chain typosquat with an operational tracking channel.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for mapkit-loader (npm). Pin to a known-safe version or switch to an alternative.