@bx-ui-framework/microfrontend

{"modified":"2026-09-04T01:12:00Z","published":"2026-09-04T01:12:00Z","schema_version":"1.7.4","id":"MAL-2026-15868","summary":"Malicious code in @bx-ui-framework/microfrontend (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e1680cbcfbae85350989b4d123a117deb73e45aad1ee7aa339cdcef34d3fbe30)\npackage.json declares a runtime dependency `microfrontend` whose source is a bare HTTPS URL at `https://repo.artifactorymanager.com/bx-ui-framework/microfrontend` rather than a version on the npm registry. The URL carries no version, commit, or hash pin, so `npm install` fetches whatever tarball is currently served at that location and executes any lifecycle scripts and code it contains inside the installer's dependency tree. The `artifactorymanager.com` domain is unrelated to any established publisher for this scope, and the tarball contents can change at any time without a version bump.\n","affected":[{"package":{"ecosystem":"npm","name":"@bx-ui-framework/microfrontend"},"versions":["15.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"2c5a09331345eb2803037ccadb50a9c946064e5f069b9f80fb4b3adf79aa64ac","tlsh":"d9e0ed3104604cb39acb4691ac6aa61a76924b3b5408bc1552ce442892eaab718fe36c"}],"package_integrity":[{"filename":"microfrontend-15.0.0.tgz","hashes":{"sha1":"b789aa1a4c17eb1b45e2a4d20988b2b427c7d5c4","sha512_sri":"sha512-zooV46lFD10gqjExiM63G49Bdo0uB7W7eSE/Qt9eMYEoNRE4V/00FSPAleyxrhRxSgapVaLAgqqzgPZ1+ap+qw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@bx-ui-framework/microfrontend/v/15.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019403","import_time":"2026-09-04T01:24:41.110013005Z","modified_time":"2026-09-04T01:12:00Z","sha256":"e1680cbcfbae85350989b4d123a117deb73e45aad1ee7aa339cdcef34d3fbe30","source":"amazon-inspector","versions":["15.0.0"]}]}}