Threats Tagged 'mal-2026-16477'
View all threats tagged with 'mal-2026-16477'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'mal-2026-16477'
Click on any threat for detailed analysis and mitigation recommendations
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (920277566757bdc38563c7e2150e906790478cbd7a0c48f0bb53004e82eec4ca) The package impersonates an Apple/Unity StoreKit internal namespace (com.apple.unityplugin.storekit) and, on require(), index.js performs an HTTPS GET to a hardcoded Project Discovery Interactsh (oast.fun) subdomain, transmitting the package name, os.platform(), and os.hostname() as query parameters (target: https://dapnhid534ch06s9vpm0mbg1httu5gytc.oast.fun). The behavior is unconditional, undocumented, and fires at module load with no caller opt-in. The name/scope, the author claim of 'Apple, Inc', and the OAST callback destination are the standard dependency-confusion reconnaissance shape: the beacon confirms that an internal build system has resolved the attacker's public package instead of Apple's private one, and leaks the internal hostname of the machine that resolved it. Join the discussion | GCVE Database | 09/23/2026, 14:10:47 UTC Added: 09/25/2026, 04:41:57 UTC |
Showing 1 to 1 of 1 result