colorpicker-ui

{"schema_version":"1.7.4","id":"MAL-2026-6473","published":"2026-06-25T20:16:17Z","modified":"2026-08-18T23:11:30.448028089Z","summary":"Malicious code in colorpicker-ui (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (226e4e81049c5688a16a198fb9a90ab3d11d371b621e367da4590632f4e5e140)\nPackage presents itself as a minimal React color-picker but ships a postinstall hook (`\"postinstall\": \"node setup.js\"`) that performs targeted credential theft and code-injection staging on `npm install`. setup.js reads classic installer secrets — `/var/run/secrets/kubernetes.io/serviceaccount/token` (Kubernetes service-account token granting cluster API access), the AWS Instance Metadata Service at `http://169.254.169.254/latest/meta-data/` (cloud instance credentials), `/etc/passwd`, `/etc/resolv.conf`, `/etc/hosts`, the full `process.env`, and runs `id` / `uname -a` plus a recursive listing of `/app`. The harvested data is wrapped as `export default \"...\";` and written to multiple attacker-chosen paths including `/app/sandbox-data/workspace/frontend/_rce.ts`, `../frontend/_rce.ts`, and `/tmp/rce.json`. The `_rce.ts` filename and the targeting of adjacent frontend workspace directories are designed to land the file inside AI coding-agent / sandbox workspaces that auto-import files from the workspace tree, converting the postinstall into arbitrary code execution in the next agent run while also exfiltrating the secrets to whatever process consumes the file. The advertised color-picker API in index.js (ColorPicker, hexToHsl, hslToHex) is functional but exists solely as cover; a color-picker library has no need to read kubernetes tokens, IMDS, or /etc/passwd at install. The log message 'generating default theme cache' printed by setup.js is deliberately misleading.\n","affected":[{"package":{"name":"colorpicker-ui","ecosystem":"npm"},"versions":["1.2.4","1.2.5","1.2.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.js","sha256":"fce8f8cf6877bb2680817a949d6b23cecae2c80040056c62d08554548674982f","tlsh":"843133e31259df7d67a7e474962f641958a7d96832013be084ad5d5a03cea0412771f0"},{"path":"package.json","sha256":"943919bc4551077306211e628b1d8781c3531356732439065a2b0aac7262a1df","tlsh":"8ee020208935577318eb537c18bb94077896181601ccbd3c26c7855c97cd6b654fd679"}],"package_integrity":[{"filename":"colorpicker-ui-1.2.4.tgz","hashes":{"sha1":"cdf170b2d141c1289d2713b224ac81aea4265ffd","sha512_sri":"sha512-UiqBpuyfu53Hj8y6fxKsEkdyXidcrn4tgQWu0R+Ngr9UTqxYsILO1Co/j0VPS2tDu0XnCw/Z/2saG7cCuOoA5w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/colorpicker-ui/v/1.2.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/colorpicker-ui/v/1.2.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/colorpicker-ui/v/1.2.6"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-007532","import_time":"2026-06-25T20:16:51.745052463Z","modified_time":"2026-06-25T20:16:17Z","sha256":"226e4e81049c5688a16a198fb9a90ab3d11d371b621e367da4590632f4e5e140","source":"amazon-inspector","versions":["1.2.4"]},{"id":"IN-MAL-2026-007533","import_time":"2026-06-25T20:16:51.844886891Z","modified_time":"2026-06-25T20:16:23Z","sha256":"f49dd7e4550f9b9e0ffa3e412a40882e9d7a45eacdc3221e590b41e3e7a15e13","source":"amazon-inspector","versions":["1.2.5"]},{"id":"IN-MAL-2026-018177","import_time":"2026-08-18T23:09:41.942373519Z","modified_time":"2026-08-18T23:05:34Z","sha256":"49c9fbe0715f0c8a5d6ce136ead1b98ac2cbc51b1135a1a00ebb550a2a4d0f0e","source":"amazon-inspector","versions":["1.2.6"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}