smb-portal-uikit

{"modified":"2026-07-14T19:49:16Z","published":"2026-07-14T19:49:16Z","schema_version":"1.7.4","id":"MAL-2026-10616","summary":"Malicious code in smb-portal-uikit (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (395b88ae26544dcfdfca9d46294e1f0558c2e5bade88bac0eb0797d1140debbe)\nPackage smb-portal-uikit@18.1.1 declares a preinstall lifecycle hook that runs `node index.js`. On `npm install`, index.js invokes child_process.exec on `whoami` and `id`, reads os.hostname(), os.userInfo(), process.platform, and process.cwd(), and POSTs the collected host reconnaissance to a hardcoded attacker-controlled endpoint at https://a2dmzqok5w5seb3fac3w4kvcz35utohd.oastify.com (an oastify.com subdomain, a Burp Collaborator out-of-band interaction host commonly used as an exfiltration/beacon sink). The package ships no legitimate UI-toolkit functionality consistent with its name; the entire install-time behavior is reconnaissance and exfiltration.\n","affected":[{"package":{"ecosystem":"npm","name":"smb-portal-uikit"},"versions":["18.1.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"039886204e0e6a6b017b00be98e85a668afe8ae2328ef703b70da99a618d600b","tlsh":"8ed05e385e22593326c506920c2ea44b62a1cf2f15053c0a93cb183cd1dea7798ff35e"}],"package_integrity":[{"filename":"smb-portal-uikit-18.1.1.tgz","hashes":{"sha1":"c18f97dbb769d217300292ab2b2b2d78f7958186","sha512_sri":"sha512-uSzNg83pCrdrEbZb/6z9qYIp9LJBfMrotzq60QgGTi7k0psR8HPoSPvAzuGTqxICKsdc2l40eMgyuqrS1lEqLA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/smb-portal-uikit/v/18.1.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010553","import_time":"2026-07-14T20:28:24.258746235Z","modified_time":"2026-07-14T19:49:16Z","sha256":"395b88ae26544dcfdfca9d46294e1f0558c2e5bade88bac0eb0797d1140debbe","source":"amazon-inspector","versions":["18.1.1"]}]}}