Malicious dependency-confusion beacon in npm package ai-workshop-maa15-radio
- Product
- ai-workshop-maa15-radio
- Affected
- ai-workshop-maa15-radio (all versions)
- Fixed in
- No fix yet
Last verified against sources: October 26, 2026
Am I affected?
ai-workshop-maa15-radio: affected ai-workshop-maa15-radio (all versions). No fix has been reported yet.
- Check your version: run
npm ls ai-workshop-maa15-radio. Versions all versions of ai-workshop-maa15-radio are affected. [1]
What to do now
- Remove the package if it is installed: run
npm uninstall ai-workshop-maa15-radio. [1] - No patched version is available; the package is listed as affected in all versions with none patched. [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
- ai-workshop-maa15-radio is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version (100.0.0) so it outranks private-registry versions, and runs node setup.js || true as a preinstall script on npm install. [1]
- Package advertises itself as a trivial string helper (reverseWords). [1]
- setup.js sends the hostname, username, working directory, OS, architecture, Node.js version and configured npm registry, with a per-package tracking token, in an HTTPS POST to https://s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook. [1]
- The npm account amel10 published ai-workshop-maa15-radio and 9 similar packages within two minutes on 2026-09-30, all with the same setup.js. [1]
Impact
- Installer host and user identifiers are transmitted to an attacker-controlled endpoint without consent, fired automatically at install time. [1]
- The version number (100.0.0) and the collection of npm_config_registry are consistent with a dependency-confusion reconnaissance beacon targeting internal package resolution. [1]
What was done
- The advisory lists the package as affected all versions, patched none. [1]
Sources
- MAL-2026-17427 — OSV (Open Source Vulnerabilities)
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
Malicious dependency-confusion beacon in npm package ai-workshop-maa15-radio
Product: ai-workshop-maa15-radio | Affected: ai-workshop-maa15-radio (all versions) | Fixed in: No fix yet
Summary: ai-workshop-maa15-radio is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version (100.0.0) so it outranks private-registry versions, and runs node setup.js || true as a preinstall script on npm install.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/09/mal-2026-17427-ai-workshop-maa15-radioCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for ai-workshop-maa15-radio
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.