@outmarket/ui

{"modified":"2026-06-23T14:12:09Z","published":"2026-06-23T14:12:09Z","schema_version":"1.7.4","id":"MAL-2026-6291","summary":"Malicious code in @outmarket/ui (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7241a2e167db383267fa82ce9660a44f7bcca4b6d4f11bb7ca85eaa6b432a47e)\npackage.json declares a postinstall script that runs automatically on `npm install` and performs `require('https').get(...)` to a Burp Collaborator subdomain (`7rzjsf29azci2qjsm6kxt23ag1mtanyc.oastify.com`), passing `os.hostname()` and `os.userInfo().username` as query parameters. Any developer or build system installing this package leaks host identity to an external attacker-controlled OAST endpoint. The package's own description (`PENTEST-PoC: Dependency confusion - SecurifyAI engagement 2026-06-23`) and the version `9.9.9` published under the `@outmarket` scope indicate the package is designed to win resolution against an internal private package of the same name and harvest beacons from anyone in the targeted organization who installs it.\n","affected":[{"package":{"ecosystem":"npm","name":"@outmarket/ui"},"versions":["9.9.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"f79b34aef25edb1847146983030a7f634d11cbcad642562ea4bc89b86c9f60d8","tlsh":"9de068f849fcf77238c408c954b22a0cb4b3d9255008ac04aae3228886941f75eb167a"}],"package_integrity":[{"filename":"ui-9.9.9.tgz","hashes":{"sha1":"4ee5f7f689d4bcc02eed83edb3a778f02bd336ae","sha512_sri":"sha512-cZrM6s3n5KxN3lF10sD/pQ0AhJ3lxvIotf6KXHUTdBY7Cd4ZUHzBg88jVpBX0mwAOrEZJN/CgX9kyI/mf+vsdQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@outmarket/ui/v/9.9.9"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-007207","import_time":"2026-06-23T14:23:03.488562279Z","modified_time":"2026-06-23T14:12:09Z","sha256":"7241a2e167db383267fa82ce9660a44f7bcca4b6d4f11bb7ca85eaa6b432a47e","source":"amazon-inspector","versions":["9.9.9"]}]}}