bx-ui-view

{"modified":"2026-09-09T01:41:04Z","published":"2026-09-09T01:41:04Z","schema_version":"1.7.4","id":"MAL-2026-16064","summary":"Malicious code in bx-ui-view (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ce3874d2c55544bbbf59b6a60c3002b13e242fb53160a455597b13fdd37231f8)\npackage.json declares a dependency whose key equals the package's own name (bx-ui-view) and whose value is a plain HTTPS URL (https://package-access.pages.dev/bx-ui-view) rather than a registry version range. On `npm install`, npm resolves this URL, downloads whatever tarball is served, and executes any lifecycle scripts inside it — with no version pin, no integrity check, and no hash/signature verification. The shipped index.js is a 3-line inert stub, so the manifest line is the entire published surface: the installer receives whatever content the operator of package-access.pages.dev chooses to serve at install time. The self-name + off-registry URL + stub source combination is the dependency-confusion / smuggled-payload shape, and the pages.dev host is unrelated to any registry or declared publisher domain.\n","affected":[{"package":{"ecosystem":"npm","name":"bx-ui-view"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"fc64b51a02331204f352df35519901b985129d6a36b78d2673feb6626ab3b63a","tlsh":"08e0263045a42caf61c41161e83a680b73328e3f020c3c0463cb8c2c439e1bb58fe31c"}],"package_integrity":[{"filename":"bx-ui-view-1.0.0.tgz","hashes":{"sha1":"1f04f1ce64472603d8d8f338aae0e15bf0a1f6e8","sha512_sri":"sha512-wvFPMeCMmM+lDunyDXikMuSMtc5xqyzoJTOEmo0Vf6gUeI8qpq6OmpU3/qonPWF7ilNJh8klqullVxRmZvVU5A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bx-ui-view/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019746","import_time":"2026-09-09T01:51:48.735364847Z","modified_time":"2026-09-09T01:41:04Z","sha256":"ce3874d2c55544bbbf59b6a60c3002b13e242fb53160a455597b13fdd37231f8","source":"amazon-inspector","versions":["1.0.0"]}]}}