Supply chain · npm · High

Malicious npm package 'com.apple.unityplugin.storekit' performs dependency confusion reconnaissance

Threat Engine Auto-Feed · data current as of 2026-09-23

The npm package 'com.apple.unityplugin.storekit' version 1.0.2 contains malicious code that impersonates an internal Apple/Unity StoreKit namespace. Upon loading, it performs an HTTPS GET request to an external domain, leaking system information. This behavior is indicative of a dependency confusion attack aimed at identifying internal build systems.

  • Package: npm / com.apple.unityplugin.storekit
  • Affected versions: = 1.0.2
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Malicious package

The npm package 'com.apple.unityplugin.storekit' version 1.0.2 was found to contain malicious code. This package impersonates an internal Apple/Unity StoreKit namespace. When the package is required, its 'index.js' file executes an unconditional and undocumented HTTPS GET request to a hardcoded Project Discovery Interactsh (oast.fun) subdomain. This request transmits the package name, operating system platform, and hostname as query parameters.

How the attack works

This is a dependency confusion attack. An attacker publishes a public package with a name that mirrors a private, internal package used by an organization. If an organization's build system or developer environment is configured to resolve dependencies from public registries before private ones, or if it lacks proper scope configuration, it might inadvertently pull the malicious public package instead of the intended private one. The malicious package then beacons out, confirming that the attack was successful and providing reconnaissance data about the internal system that resolved it.

Who's exposed

Profiles most at risk

  • Organizations or teams using the npm ecosystem that might have internal packages with names similar to 'com.apple.unityplugin.storekit'
  • Development teams whose CI/CD pipelines or local development environments are configured to pull the latest versions of dependencies without strict version pinning
  • Organizations that use internal npm mirrors or proxies without robust private package enforcement

Conditions that increase exposure

  • Unpinned dependencies in 'package.json' that allow resolution to the malicious version
  • Lack of a 'package-lock.json' or 'npm-shrinkwrap.json' file to ensure deterministic dependency resolution
  • Build systems or developer environments configured to prioritize public npm registries over private ones for package resolution
  • Internal package naming conventions that overlap with publicly available malicious packages

Blast-radius scenarios

  • An attacker successfully identifies an organization's internal package names and confirms that their malicious public package was pulled, indicating a potential vulnerability in the organization's dependency resolution process.
  • The attacker gains reconnaissance data, including the hostname and operating system platform of the internal machine that resolved the malicious package, which could be used for further targeted attacks.
  • The installation of this package could lead to the compromise of developer workstations or build servers, serving as an initial foothold for broader network access or data exfiltration.

What to do (defensive)

Detect

  • Scan dependency trees for 'com.apple.unityplugin.storekit' version 1.0.2.
  • Monitor network traffic from build systems and developer machines for outbound HTTPS GET requests to 'dapnhid534ch06s9vpm0mbg1httu5gytc.oast.fun' or other suspicious external domains.
  • Review npm package logs and audit trails for installations of the affected package.
  • Implement software composition analysis (SCA) tools to identify known malicious packages in your dependencies.

Contain

  • Immediately block network access to 'dapnhid534ch06s9vpm0mbg1httu5gytc.oast.fun' from all internal systems.
  • Quarantine or isolate any systems identified as having installed 'com.apple.unityplugin.storekit@1.0.2'.
  • Review and update npm registry configurations to prioritize private registries for internal package scopes.
  • Enforce strict package naming conventions and scope configurations to prevent dependency confusion.

Remediate

  • Remove 'com.apple.unityplugin.storekit@1.0.2' from all affected projects and systems.
  • Update 'package.json' files to use strict version pinning for all dependencies.
  • Generate and commit 'package-lock.json' or 'npm-shrinkwrap.json' files to ensure deterministic builds.
  • Educate development teams on dependency confusion risks and secure package management practices.
  • Consider implementing a private npm registry or proxy that can enforce strict package resolution rules.

Frontier verdict — High

Prioritize immediate detection and removal of 'com.apple.unityplugin.storekit@1.0.2' due to its critical severity and role in dependency confusion reconnaissance.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.