@catamania/ui-components

{"modified":"2026-05-13T20:13:32Z","published":"2026-05-12T07:44:27Z","schema_version":"1.7.4","id":"MAL-2026-3681","summary":"Malicious code in @catamania/ui-components (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (326cc4cf1fbe96c77b6340df59ebea040cdd522e3e4bc76471563190044cf53a)\nThe package declares a postinstall lifecycle hook (`\"postinstall\": \"node postinstall.js\"` in package.json) that runs automatically during `npm install`. postinstall.js (lines 1-22) collects `os.hostname()`, `os.userInfo().username`, `process.cwd()`, and the entire `process.env` object, JSON-serializes them, and POSTs the payload over HTTPS to `attacker.appsec.cc:9999/exfiltrate`. On developer workstations and CI runners, `process.env` routinely contains high-value secrets (NPM_TOKEN, GITHUB_TOKEN, AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, CI provider tokens, database URLs). Errors are swallowed silently, a classic exfiltration-stealth technique. The package self-describes as internal UI components, which provides no legitimate justification for reading or transmitting environment variables. This is an unambiguous credential-theft supply-chain attack against the installer.\n","affected":[{"package":{"ecosystem":"npm","name":"@catamania/ui-components"},"versions":["1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"domains":["attacker.appsec.cc"],"evidence_files":[{"path":"postinstall.js","sha256":"67b38f0c558ee3252b546ec37c40eab872a6889f6a9f772fa6fc6127aba7e14e","tlsh":"23f050f453a2d7a10eb9a1c4e085ec1712b3d101760b68a0b6d443a86fcd6fc1872ce4"}],"package_integrity":[{"filename":"ui-components-1.0.1.tgz","hashes":{"sha1":"2f9ed9681a4b50dc9d0b64c81a1775b5e8aebbca","sha512_sri":"sha512-eUew8dlpi72Lot3kgp/ssVODcWHXgxN5JHYWWDkCQpJMtlJqYjPvSTPo9mQrxqOtpaQZO0ah9ldwWF7ScvFU4w=="}}],"urls":["https://attacker.appsec.cc:9999/exfiltrate"]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@catamania/ui-components/v/1.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-002442","import_time":"2026-05-13T20:10:57.097743954Z","modified_time":"2026-05-12T19:03:07Z","sha256":"326cc4cf1fbe96c77b6340df59ebea040cdd522e3e4bc76471563190044cf53a","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-002443","import_time":"2026-05-13T20:10:57.14762113Z","modified_time":"2026-05-12T18:35:19Z","sha256":"c318ae20e084477c4fd6d3f8408e68d4a4d0596a365adf4efe2f94fb5c22aedb","source":"amazon-inspector","versions":["1.0.1"]}]}}