uibabai

{"modified":"2026-08-05T00:53:07Z","published":"2026-08-05T00:53:07Z","schema_version":"1.7.4","id":"MAL-2026-12054","summary":"Malicious code in uibabai (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2680f37e219fec8bf9af5b922534ccb483a6b0503d0158cccaa0c152ed6b7484)\nindex.js has malicious code appended after a legitimate Tailwind plugin export. On any require()/import of the package, the appended block queries the public Ethereum RPC eth.drpc.org for a transaction from the hardcoded address 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a, derives an IPv4 C2 endpoint from the first 4 bytes of the transaction's `to` field, fetches XOR-encrypted payloads over plain HTTP from paths /0x/cls and /0x/ls, and executes the decrypted bytes via `eval` and a spawned `node -e` child process. Identifiers such as `require`, `http`, `https`, `child_process`, `POST`, `application/json`, `base64`, and the `eth_blockNumber`/`eth_getBlockByNumber` RPC method names are hidden behind `\\uXXXX` unicode escapes, and server responses are XOR-decoded before execution. The blockchain lookup functions as a dead-drop resolver so the C2 IP can be rotated by publishing a new Ethereum transaction without modifying the package.\n","affected":[{"package":{"ecosystem":"npm","name":"uibabai"},"versions":["5.7.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"d0369cd2d8794f3bda662118c69c8fc060fff88b638eca4d7faf839e8c0340fb","tlsh":"c0c142b5937d9e1a81725818cc76680ee1b890933e6fe820bd2f34c9df5d3d497a2784"}],"package_integrity":[{"filename":"uibabai-5.7.5.tgz","hashes":{"sha1":"2859f7347901f24ce2b351560d302483f26f9e09","sha512_sri":"sha512-7ie0bJQrMR3slGb3ldlhdAhMXywJFKhCVMwEIvM6JqdlB6BsE0+9Au2jlL0uQaUHzxUeQNatR60slrjYhY/CNg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/uibabai/v/5.7.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-011470","import_time":"2026-08-05T01:39:30.445725675Z","modified_time":"2026-08-05T00:53:07Z","sha256":"2680f37e219fec8bf9af5b922534ccb483a6b0503d0158cccaa0c152ed6b7484","source":"amazon-inspector","versions":["5.7.5"]}]}}