@birbalo/aliftech-ui

{"modified":"2026-09-24T13:15:58Z","published":"2026-09-24T13:15:58Z","schema_version":"1.7.4","id":"MAL-2026-17153","summary":"Malicious code in @birbalo/aliftech-ui (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f6392dad6c7467b1d2b75c329d517982f061f3ca0792b8879b72127813d26aa8)\nThe npm package @birbalo/aliftech-ui@99.9.9 ships a postinstall.js lifecycle script that runs automatically on npm install. The script imports the built-in os and https modules, reads os.hostname() and os.userInfo().username, and issues an HTTPS GET to https://webhook.site/539f8bb9-497a-4104-92f7-f95a77204cc2/<hostname>/<username>, transmitting installer host identifiers to a third-party inspection endpoint. The package name uses a scope that resembles an internal/organization namespace and is published at version 99.9.9 — a version-number shape consistent with dependency-confusion beacons designed to win resolution against a private package of the same name. Installing this package causes any host that runs npm install (developer workstations, CI runners) to report its hostname and login user to the attacker-controlled collector, providing reconnaissance for follow-on targeting of the affected environments.\n","affected":[{"package":{"ecosystem":"npm","name":"@birbalo/aliftech-ui"},"versions":["99.9.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"da89ffe92db45a0039edb7a241042688a4430f1b3858f0a199f54704319a5a4a","tlsh":"dee0d8f862f393341a7945c491415c0ada93912876a6c8c5da9812f1d6d2ab8ddd01b4"}],"package_integrity":[{"filename":"aliftech-ui-99.9.9.tgz","hashes":{"sha1":"f9b200a3f61c5193bc77e6b7d3bd2421c35af9b3","sha512_sri":"sha512-2VJzb+jBnAxzjQs4aWD5fVIJJUaQgxSebkldvkPG7pWeTERBzJSk11rJNLrevr05ncof371rq+lQwhT+JXq7Uw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@birbalo/aliftech-ui/v/99.9.9"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020503","import_time":"2026-09-24T13:18:04.181697093Z","modified_time":"2026-09-24T13:15:58Z","sha256":"f6392dad6c7467b1d2b75c329d517982f061f3ca0792b8879b72127813d26aa8","source":"amazon-inspector","versions":["99.9.9"]}]}}