MalwarePublished 23 Sep 2026Updated 12 Oct 2026

com.apple.unityplugin.storekit (npm) · Malicious Code

Affects com.apple.unityplugin.storekitSource GCVE Database

Malicious package : remove com.apple.unityplugin.storekit and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:22 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-16477

What to do

Remove com.apple.unityplugin.storekit from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmcom.apple.unityplugin.storekit	Affected =1.0.2 =1.0.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (920277566757bdc38563c7e2150e906790478cbd7a0c48f0bb53004e82eec4ca) The package impersonates an Apple/Unity StoreKit internal namespace (com.apple.unityplugin.storekit) and, on require(), index.js performs an HTTPS GET to a hardcoded Project Discovery Interactsh (oast.fun) subdomain, transmitting the package name, os.platform(), and os.hostname() as query parameters (target: https://dapnhid534ch06s9vpm0mbg1httu5gytc.oast.fun). The behavior is unconditional, undocumented, and fires at module load with no caller opt-in. The name/scope, the author claim of 'Apple, Inc', and the OAST callback destination are the standard dependency-confusion reconnaissance shape: the beacon confirms that an internal build system has resolved the attacker's public package instead of Apple's private one, and leaks the internal hostname of the machine that resolved it.

Impact

The package leaks internal hostnames and environment information to an external attacker-controlled server, potentially exposing internal build infrastructure details. This can aid attackers in identifying and targeting internal systems. There is no indication of direct code execution beyond the reconnaissance beacon, nor evidence of active exploitation in the wild.

Defensive guidance

Users should avoid installing or requiring this package. Verify that internal build systems do not resolve public packages that impersonate internal namespaces. Monitor dependency sources carefully to prevent dependency confusion attacks.

Summary

This malicious npm package masquerades as an internal Apple/Unity StoreKit module. Upon being required, its index.js script unconditionally sends an HTTPS GET request to a Project Discovery Interactsh subdomain, transmitting sensitive environment details such as the package name, os.platform(), and os.hostname(). This action occurs without user consent or documentation, signaling an attempt to confirm if an internal build system mistakenly resolved the attacker's public package instead of the legitimate private one. The leak of internal hostnames and environment data facilitates further targeted attacks or reconnaissance.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 25 Sep 2026, 04:43 UTC

Technical details

References

Community reviews