com.apple.unityplugin.storekit

Details

**Severity:** Critical

**Affected versions:** `= 1.0.2`

## Source: amazon-inspector (920277566757bdc38563c7e2150e906790478cbd7a0c48f0bb53004e82eec4ca)
The package impersonates an Apple/Unity StoreKit internal namespace (com.apple.unityplugin.storekit) and, on require(), index.js performs an HTTPS GET to a hardcoded Project Discovery Interactsh (oast.fun) subdomain, transmitting the package name, os.platform(), and os.hostname() as query parameters (target: https://dapnhid534ch06s9vpm0mbg1httu5gytc.oast.fun). The behavior is unconditional, undocumented, and fires at module load with no caller opt-in. The name/scope, the author claim of 'Apple, Inc', and the OAST callback destination are the standard dependency-confusion reconnaissance shape: the beacon confirms that an internal build system has resolved the attacker's public package instead of Apple's private one, and leaks the internal hostname of the machine that resolved it.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/4ff50359dc7f9c5ce6f1dae607fd8c96dfc8b5d2/osv/malicious/npm/com.apple.unityplugin.storekit/MAL-2026-16477.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/4ff50359dc7f9c5ce6f1dae607fd8c96dfc8b5d2/osv/malicious/npm/com.apple.unityplugin.storekit/MAL-2026-16477.json
- https://www.npmjs.com/package/com.apple.unityplugin.storekit/v/1.0.2
- https://github.com/ossf/malicious-packages/blob/c93fda3f08313c598165839b4fb8b4d4d912f27a/osv/malicious/npm/com.apple.unityplugin.storekit/MAL-2026-16477.json
- https://www.npmjs.com/package/com.apple.unityplugin.storekit/v/1.0.1
- https://github.com/advisories/GHSA-6r46-f382-x53p

Compromised versions (1)

• = 1.0.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.