mui-wrapper-x-date-pickers@10.0.0
Vulnerability report · Last retrieved from osv.dev October 30, 2026 at 1:02 AM UTC
OSV ID
MAL-2026-18369
Ecosystem
npm
Summary
On npm install, the package's preinstall and postinstall lifecycle scripts issue plaintext HTTP GET requests to the hardcoded bare-IP endpoint http://38.242.235.206/depconf/mui-wrapper-x-date-pickers/{preinstall,postinstall}, carrying the installer's OS username (process.env.USER / process.env.USERNAME), hostname (os.hostname()), and current working directory (process.cwd()) as query parameters. The package name follows a dependency-confusion lure pattern (mui-wrapper-x-date-pickers resembles the @mui/x-date-pickers family), and resolution of this public name causes automatic, unauthenticated host-identity disclosure to a bare-IP endpoint with no documented operator. No TLS, no opt-in, no caller configuration.
Source: amazon-inspector (70c4d8b55d25fd65b5a7e7f95fbdedaf5619bc13f07f277aad725e208188020b)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.