cilm-ui-commons

{"modified":"2026-08-13T17:20:59Z","published":"2026-08-13T17:20:59Z","schema_version":"1.7.4","id":"MAL-2026-13943","summary":"Malicious code in cilm-ui-commons (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (008641dff89b7e4b86993671997e965642fab5620006c5ece0827f0fe72fe0d9)\nOn npm install, the preinstall hook executes index.js which collects host identity data (os.hostname(), os.userInfo().username, os.homedir(), current working directory, DNS server list) together with the full package.json contents and POSTs them to the hardcoded external endpoint https://eogo57c0daum9d3.m.pipedream.net. The behavior fires unconditionally at install time on every installer machine. A code comment references burpcollaborator/Interactsh-style beaconing, consistent with dependency-confusion reconnaissance: the beacon fires when a private internal package name is inadvertently resolved from the public npm registry, revealing the victim's internal infrastructure to whoever controls the pipedream endpoint. The exfiltrated fields identify the installer's host, user account, filesystem layout, network DNS configuration, and internal package/dependency graph.\n","affected":[{"package":{"ecosystem":"npm","name":"cilm-ui-commons"},"versions":["1.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"0b3de46126a6c8c5d68464db99870ca04c9a54af068c9f9ac81b59ebb7386f71","tlsh":"d811add985e2236009b659c47899d00816aad737790e6de8b58d47d40fceafc70b3af1"}],"package_integrity":[{"filename":"cilm-ui-commons-1.1.0.tgz","hashes":{"sha1":"e31f1374562ef65ea0a0c77c8bb69015db8dbf43","sha512_sri":"sha512-KztyDRk+C2+sOeNP44MA3KyX0YsAV1SQeQCD4qLmTyQRmjT0PusZzSBJo0pPbDqWUmPSQmoPmZ0KFC89KTkhsg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cilm-ui-commons/v/1.1.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017652","import_time":"2026-08-13T17:24:46.043024512Z","modified_time":"2026-08-13T17:20:59Z","sha256":"008641dff89b7e4b86993671997e965642fab5620006c5ece0827f0fe72fe0d9","source":"amazon-inspector","versions":["1.1.0"]}]}}