MAL-2026-18448: Malicious code in @mobile-platform/magnetic-components (npm)

Published Oct 29, 2026

Updated

@mobile-platform/magnetic-components is a dependency-confusion package: its description says the scoped name is referenced in the Meraki Dashboard Android app's bundled JavaScript and was unclaimed on the public registry, so a build that resolves @mobile-platform from npm runs its code instead of the intended private package. Its preinstall script runs node preinstall.js on npm install; in 0.0.1 and 0.0.2 it writes DEPENDENCYCONFUSIONPOCMARKER.txt into the working directory, and in 0.0.3 it makes a DNS lookup of a fixed subdomain of dbhmeq71af5395un3p70tujr84cuwuyg7.oast.me, an interactsh callback host, signalling that the package was installed. It sends no host data beyond the lookup itself, but unreviewed code from an outside publisher has run with the installing user's privileges. The npm account io-8 published the three versions on 2026-10-29.

Affected Software

1 affected component

npm/@mobile-platform/magnetic-components=0.0.1, =0.0.2, =0.0.3

Event History

Oct 29, 2026

Advisory Published

via OSV·03:19 PM

Data Sourced

via OSV·03:19 PM

DescriptionAffected Software

Frequently Asked Questions

Which builds are exposed to this package?

Builds are exposed if they resolve the @mobile-platform scope from the public npm registry and install @mobile-platform/magnetic-components instead of the intended private package. The package's preinstall script runs during npm installation with the privileges of the installing user.

What evidence indicates that the package was installed?

Versions 0.0.1 and 0.0.2 create a file named DEPENDENCY_CONFUSION_POC_MARKER.txt in the working directory. Version 0.0.3 performs a DNS lookup to a fixed subdomain of dbhmeq71af5395un3p70tujr84cuwuyg7.oast.me, so DNS logs may show that callback domain.

What activity did the package perform?

The documented behavior is a preinstall script that either writes the marker file in versions 0.0.1 and 0.0.2 or makes the DNS callback in version 0.0.3. No host data is reported as being sent beyond the DNS lookup, but the outside publisher's code executed with the installing user's privileges.

MAL-2026-18448: Malicious code in @mobile-platform/magnetic-components (npm)

Affected Software

Event History

Frequently Asked Questions

Which builds are exposed to this package?

What evidence indicates that the package was installed?

What activity did the package perform?

Company

Resources

Contact

Frequently Asked Questions

Which builds are exposed to this package?

What evidence indicates that the package was installed?

What activity did the package perform?