syft-acp-uikit

{"schema_version":"1.7.4","id":"MAL-2026-10766","published":"2026-07-16T00:00:00Z","modified":"2026-08-06T14:21:56.301826832Z","summary":"Malicious code in syft-acp-uikit (npm)","details":"The syft-acp-uikit package was published to the npm registry by user 'ada8877' (maintainer email k3mlol@proton.me) as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention (an ACP component library) of a target organization, so that a misconfigured resolver installs this public lookalike instead of the intended private dependency.\n\nThe package declares a preinstall hook (\"npm install @sentry/node && node examples/verify.js\") that executes automatically at npm install time, before any application code runs. The bundled examples/verify.js initializes the @sentry/node client against a hardcoded, attacker-controlled Sentry DSN with sendDefaultPii enabled, resolves the installing host's public egress IP address by requesting Cloudflare's /cdn-cgi/trace endpoint (using a spoofed desktop-browser User-Agent to bypass bot challenges), then deliberately triggers a runtime exception and captures it. Flushing the event beacons the collected host telemetry (public IP plus Sentry default PII such as hostname, OS username and runtime/environment metadata) to the attacker's Sentry ingest endpoint at o4510485815754752.ingest.us.sentry.io.\n\nEach impersonated namespace in the campaign beacons to a distinct Sentry project ID, letting the operator attribute successful installs to specific victim organizations — behaviour consistent with a dependency-confusion reconnaissance beacon rather than legitimate error monitoring. The install-time payload is byte-for-byte identical to the earlier 'click2ai' campaign, sharing the same Sentry organization (o4510485815754752) and a related ProtonMail maintainer identity, and differs only in the package name and target DSN. This package's beacon targets Sentry project 4511744089718784.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (694d28b5d3d4fc19b2dc3399b982cc5333b4bc73fcdd45754194e9689737ee18)\nThe package declares a preinstall script that runs examples/verify.js, which initializes @sentry/node against a hardcoded author-controlled Sentry DSN (https://e82e1244d311e1f83fd57d89db4d62a3@o4510485815754752.ingest.us.sentry.io/4511744089718784), fetches the installer's public egress IP via https://www.cloudflare.com/cdn-cgi/trace, triggers an error, and flushes a Sentry event carrying the resolved IP to the author's project on every npm install. src/index.js additionally hardcodes the same DSN as DEFAULT_DSN and sets sendDefaultPii: true, so consumers who call init() without an explicit dsn silently route their captured error events and PII to the same author-controlled destination. The package name evokes the unrelated 'syft' ecosystem and a UI toolkit while its actual code is a thin Sentry wrapper against an author-owned DSN, and the README is a two-line stub — a name/behavior mismatch consistent with an impersonation lure.\n","affected":[{"package":{"name":"syft-acp-uikit","ecosystem":"npm"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.9.45","1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"examples/verify.js","sha256":"d9b24679ee510878db77696e7e5524fe7359c7ae6827a816e18341b0f395bb82","tlsh":"8e21beace8f75573217b10885b1b14563ab206c22309f992badc8f6f5fc1c25d27399a"},{"path":"src/index.js","sha256":"56d11190ab3ba5b0934c557b112955d8782bd8054348bef2d3a0a2bcbdef804a","tlsh":"e012959a34f6332301e250f0025f90d97365d67a3379a9e071598be92fd90b8d6b3ec9"},{"path":"package.json","sha256":"ffed4c287f17a8e200c702c82ba8ee5a8950921cf8e195d3f433df374c5d8a3d","tlsh":"fbf078508d742f2316d4b7b56c690146a764ce4701a43d1936cb022d4f8c77f24ff5ae"}],"package_integrity":[{"filename":"syft-acp-uikit-1.9.45.tgz","hashes":{"sha1":"bb33525248e63774cfa60a5156511e7b864f7238","sha512_sri":"sha512-OKR2i92gqz4nMaDSQlddebmsvBVaC5OtybxA3wIy6YGKJr+1AhvRDwBmyJT+0dTLzK6VJTTR9AUt/mkkC276FQ=="}}]},"iocs":{"domains":["o4510485815754752.ingest.us.sentry.io"],"urls":["https://e82e1244d311e1f83fd57d89db4d62a3@o4510485815754752.ingest.us.sentry.io/4511744089718784"]}}}],"references":[{"type":"WEB","url":"https://www.npmjs.com/package/syft-acp-uikit"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/syft-acp-uikit/v/1.9.45"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/syft-acp-uikit/v/1.0.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-011308","import_time":"2026-08-04T22:30:10.22318816Z","modified_time":"2026-08-04T22:02:41Z","sha256":"694d28b5d3d4fc19b2dc3399b982cc5333b4bc73fcdd45754194e9689737ee18","source":"amazon-inspector","versions":["1.9.45"]},{"id":"IN-MAL-2026-016544","import_time":"2026-08-06T14:19:54.673652168Z","modified_time":"2026-08-06T13:56:15Z","sha256":"ebebc8c4bd637b252ec48552b67e795fc287f8d8fc314d3b35e4b090f5f1d9e3","source":"amazon-inspector","versions":["1.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"SafeDep","contact":["https://safedep.io"],"type":"FINDER"}]}