@dbbhk/ui-components

{"modified":"2026-09-21T03:28:30Z","published":"2026-09-21T03:28:30Z","schema_version":"1.7.4","id":"MAL-2026-16319","summary":"Malicious code in @dbbhk/ui-components (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (478839dda68d2c5eefa1a55557602d4b12396c988211b28d785af531d0b19d07)\n@dbbhk/ui-components@99.0.0 declares both preinstall and postinstall hooks in package.json that execute `node callback.js`, so the payload runs automatically on `npm install`. callback.js queries the AWS instance metadata service at 169.254.169.254 for IAM role credentials, reads ECS task-role credentials via AWS_CONTAINER_CREDENTIALS_RELATIVE_URI, iterates process.env harvesting variables matching AWS/SECRET/KEY/TOKEN/PASSWORD/CREDENTIAL/AUTH/API/NPM/GITHUB/GITLAB patterns, and reads credential files including ~/.aws/credentials, /root/.aws/credentials, ~/.npmrc,.env,.npmrc, and the Kubernetes service-account token at /var/run/secrets/kubernetes.io/serviceaccount/token. It also collects host reconnaissance (hostname, whoami, id, platform, cwd, home directory, and CI-provider fingerprint for GitHub Actions/GitLab/Jenkins). Collected data is POSTed via https.request to api.telegram.org/bot<token>/sendMessage against a hardcoded Telegram bot and chat id 1064260758. The package name and scope impersonate an HSBC internal component (dependency-confusion shape with an implausibly high 99.0.0 version), and a header comment self-labels the file as an HSBC bug-bounty PoC; the code performs indiscriminate credential harvesting on any installer regardless of that framing.\n","affected":[{"package":{"ecosystem":"npm","name":"@dbbhk/ui-components"},"versions":["99.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"1c8c7ef24ca7ebacbea5db5e4855e452ed4116deb6a5162dfc23f7cfedec4d9d","tlsh":"17f1547c61f274103a9b95fea79fa1017037f0033984da96baec42519f4689cc5e3ae9"}],"package_integrity":[{"filename":"ui-components-99.0.0.tgz","hashes":{"sha1":"d7a62a450fbcdfdb2558f9fc0c9cbede98763c6f","sha512_sri":"sha512-J5flbO3ZwhP05x7L33LZ8QZfvWj+OP1o0Za1F5hQjPGx4X8OChGPq6O79+M3L0JCgJwzr5U762G7FlW8j9MaXA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@dbbhk/ui-components/v/99.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020216","import_time":"2026-09-21T03:46:36.712698803Z","modified_time":"2026-09-21T03:28:30Z","sha256":"478839dda68d2c5eefa1a55557602d4b12396c988211b28d785af531d0b19d07","source":"amazon-inspector","versions":["99.0.0"]}]}}