npm · disclosed 23 October 2026

Dependency-confusion probes mimicking internal front-end libraries

Public packages squatting internal-looking scopes (@ecg-internal, @grabcad, @blueskydataplatform and others) run a beacon at install that reports the host, path and Node version to a hard-coded server.

Detectable by a website scanNo, server-side only
Last reviewed23 October 2026

Affected packages

Package	Affected versions
`@ecg-internal/*`	all
`@grabcad/*`	all
`@blueskydataplatform/shared-ui`	all

What to do

If your organisation uses private packages with these names, make sure your registry is scoped so public look-alikes can't be installed.

Sources

OSV MAL-2026-18206 (@ecg-internal/adobe-dmp-js)
OSV MAL-2026-18212 (@blueskydataplatform/shared-ui)

We update this page as new information is published. Package versions are also checked live against OSV.dev during every audit, so newly flagged versions are caught even before this page changes.