@telekom-ods/react-ui-kit

{"schema_version":"1.7.4","id":"MAL-2026-13770","published":"2026-08-11T00:00:00Z","modified":"2026-08-12T14:33:10.748456329Z","summary":"Malicious code in @telekom-ods/react-ui-kit (npm)","details":"@telekom-ods/react-ui-kit@2.6.9 ships an install hook that spawns a shell running a reconnaissance/exfiltration one-liner. The captured command reads `/etc/passwd` and `/etc/hosts`, runs `id`, and conditionally reads `/etc/shadow` if the process has read access, then sends the collected output as the `User-Agent` header of an HTTP POST to an out-of-band interaction (OAST) callback host at `d9t83osijf9n1gb62e4gxfioysijywqww.oast.me`, with the victim's `whoami` and `hostname` output embedded directly in the callback URL path (`/telekom-ods/$(whoami)/$(hostname)/`) — allowing the operator to both fingerprint each compromised host and receive system file contents in a single request, without needing to run a listener that logs POST bodies.\n\nSandbox capture of the spawned command was truncated after the `/etc/shadow` conditional; the exact fields exfiltrated beyond `/etc/passwd`, `/etc/hosts`, and `id` output were not fully recovered, but the confirmed portion already demonstrates local system file exfiltration via OAST callback, independent of whatever else the full script sends.\n\nThe npm registry metadata for this version showed the same publisher (`telekom-ods`) as prior legitimate releases under this scope, rather than a fresh or newly-registered account, suggesting either a compromised maintainer account/token or a supply-chain injection into the release pipeline rather than a simple namesquat. The package has since been fully removed from npm (the scope currently resolves with zero published versions).\n\nAny environment where this version was installed should be treated as having had `/etc/passwd`, `id` output, and possibly `/etc/shadow` (on hosts where the installing user had read access) exposed to the attacker via the OAST callback; treat local user credentials and any password hashes present on the host as compromised and rotate accordingly.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4b739fe95d8950990211dd6172d27e910aad10de90b7bdd86174ce021c7de676)\nThe package.json preinstall hook runs `node index.js`, which reads `os.hostname()` and `os.userInfo().username` and issues an HTTPS GET to a hardcoded subdomain of `oast.online`, embedding those host identifiers in the URL path (e.g. `https://d9t67n4ijf9j5pmd6ug0sij3zd49twn1k.oast.online/telekomDT/<hostname>-<username>`). The scope `@telekom-ods` mimics an internal Deutsche Telekom namespace, and the automatic install-time callout to an out-of-band interaction service is the classic dependency-confusion probe shape: any environment that installs this name reveals its hostname and username to whoever controls the OAST collaborator token. Even if self-described as a research PoC, the published artifact performs unauthenticated exfiltration of installer identifiers on `npm install`.\n","affected":[{"package":{"name":"@telekom-ods/react-ui-kit","ecosystem":"npm"},"versions":["2.6.9","2.6.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"20ac2f256372edec71bae6f5a0d40e3288022ead0f8eff39893bd95e17d0b7e2","tlsh":"65f0dc8f5cf8d93276a508bcef04541b771bfba09032f79364ef4a18235c88844565a6"}],"package_integrity":[{"filename":"react-ui-kit-2.6.9.tgz","hashes":{"sha1":"69d6e8cf1d08aabad02ec1690238cadb7f323251","sha512_sri":"sha512-cyuuPlyzWWr4tg8o2/W8H1yzVcP8mk3B7/2SnnzqFNbuO8EV+ZlQ3EvVsDsyE/YmUjIpK8Rrn/3do5d9yxcHYg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@telekom-ods/react-ui-kit"},{"type":"ARTICLE","url":"https://o3.security/blog/crypto-defi-npm-supply-chain-attack-npmrc-exfiltration"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@telekom-ods/react-ui-kit/v/2.6.9"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@telekom-ods/react-ui-kit/v/2.6.0"}],"database_specific":{"iocs":{"domains":["d9t83osijf9n1gb62e4gxfioysijywqww.oast.me"],"urls":["http://d9t83osijf9n1gb62e4gxfioysijywqww.oast.me/telekom-ods/"]},"malicious-packages-origins":[{"id":"IN-MAL-2026-017458","import_time":"2026-08-12T12:51:43.251031238Z","modified_time":"2026-08-12T12:24:32Z","sha256":"890292252655a30cabe5976dadafba60886509fb7a09bf7b247cfb926f51595f","source":"amazon-inspector","versions":["2.6.9"]},{"id":"IN-MAL-2026-017575","import_time":"2026-08-12T14:31:16.819547086Z","modified_time":"2026-08-12T14:05:49Z","sha256":"4b739fe95d8950990211dd6172d27e910aad10de90b7bdd86174ce021c7de676","source":"amazon-inspector","versions":["2.6.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"O3 Security","contact":["https://o3.security"],"type":"FINDER"}]}