@siriusbeyond/ui

{"modified":"2026-09-21T03:28:50Z","published":"2026-09-21T03:28:50Z","schema_version":"1.7.4","id":"MAL-2026-16321","summary":"Malicious code in @siriusbeyond/ui (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3d81713c34940a8d3511a53c6cb8001481734bc2493be23d0f6ddb1dd561fa72)\nOn npm install, both preinstall and postinstall lifecycle hooks execute callback.js, which collects installer host identity (hostname, username, platform, cwd, home directory, UID, CI/cloud indicators, npm registry) and enumerates the names of environment variables matching credential-shaped patterns (token, secret, key, password, auth, api, aws, azure, npm, git, docker, registry, artifactory, nexus, credential), then POSTs the collected data to api.telegram.org via a hardcoded bot token and chat id (1064260758) using https.request to /bot<token>/sendMessage. The lifecycle commands are wrapped in `2>/dev/null || true` to suppress errors and hide the exfil from the installer during `npm install`. A README framing this as a dependency-confusion proof of concept does not change the behavior: the package auto-executes credential-context reconnaissance and host fingerprinting against installer machines and transmits the results to an attacker-controlled Telegram channel.\n","affected":[{"package":{"ecosystem":"npm","name":"@siriusbeyond/ui"},"versions":["99.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"92acd9d29ba169e07719394d8c8a097a29cd548d4fa5f3afa38a9c953675e90d","tlsh":"ca71e7c852ebd5221be116d76559bc036946e0073f0db1623a1c53906fc896d87727ff"},{"path":"package.json","sha256":"8dfa458e92382a947a46245bfab4ae8f1e631f6cb417d84290317b99959486af","tlsh":"48e0f1646e180b233decced82435c60190399d0f0cac782513b3498842ce7634a7d3bf"}],"package_integrity":[{"filename":"ui-99.0.0.tgz","hashes":{"sha1":"9bc4a21b558cee2366c73bfba314bed082abfac9","sha512_sri":"sha512-17f5JMdWC9/efwLuZp5SdMkkHUatz0Faw7ORIzkmnimX+dhiXLT2C/1NE7/GPWWCB8wIZ6/C2uP/8LVO62WPhg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@siriusbeyond/ui/v/99.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020218","import_time":"2026-09-21T03:46:36.882182639Z","modified_time":"2026-09-21T03:28:50Z","sha256":"3d81713c34940a8d3511a53c6cb8001481734bc2493be23d0f6ddb1dd561fa72","source":"amazon-inspector","versions":["99.0.0"]}]}}