@ppa-web-components/ppa-banner

GHSA-2g28-gqgq-ghvf

Malicious code in @ppa-web-components/ppa-banner (npm)

Details

**Severity:** Critical

**Affected versions:** `= 2.0.0`

## Source: amazon-inspector (bcf0b03540a27943a2afcc26927ce7256d85328bc4fcbc2562f36a88ad75ce8d)
@ppa-web-components/[email protected] is described as a 'Compatibility shim' but ships only two code paths: a no-op Proxy as its main export, and beacon.cjs. beacon.cjs defines BEACON = "http://185.158.107.175:8787/_ah/dc" and a fire() function that POSTs a JSON payload containing the package name, os.hostname(), the install path (__dirname), process.cwd(), and the Node/npm version to that bare-IP, plain-HTTP endpoint. fire() is invoked both from the postinstall lifecycle hook (`node beacon.cjs`) and from the module's main entry, so the beacon fires automatically on `npm install` and again whenever the package is required. The destination is an unrelated bare IP over cleartext HTTP, not any publisher-controlled or registry infrastructure, and the shipped stub has no functional purpose other than the beacon. The scoped-name + stub + install-time recon beacon shape is consistent with a dependency-confusion recon callback used to identify internal build environments that resolved this public name.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/b711d7c76f98b5044512e8c851547e8a05b2f959/osv/malicious/npm/@ppa-web-components/ppa-banner/MAL-2026-18272.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/b711d7c76f98b5044512e8c851547e8a05b2f959/osv/malicious/npm/@ppa-web-components/ppa-banner/MAL-2026-18272.json
- https://www.npmjs.com/package/@ppa-web-components/ppa-banner/v/0.0.1
- https://www.npmjs.com/package/@ppa-web-components/ppa-banner/v/1.0.0
- https://www.npmjs.com/package/@ppa-web-components/ppa-banner/v/1.0.1
- https://www.npmjs.com/package/@ppa-web-components/ppa-banner/v/1.1.0
- https://www.npmjs.com/package/@ppa-web-components/ppa-banner/v/2.0.0
- https://www.npmjs.com/package/@ppa-web-components/ppa-banner/v/2.0.1
- https://www.npmjs.com/package/@ppa-web-components/ppa-banner/v/3.0.0

Compromised versions (1)

= 2.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.