{"id":"MAL-2026-17153","summary":"Malicious code in @birbalo/aliftech-ui (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f6392dad6c7467b1d2b75c329d517982f061f3ca0792b8879b72127813d26aa8)\nThe npm package @birbalo/aliftech-ui@99.9.9 ships a postinstall.js lifecycle script that runs automatically on npm install. The script imports the built-in os and https modules, reads os.hostname() and os.userInfo().username, and issues an HTTPS GET to https://webhook.site/539f8bb9-497a-4104-92f7-f95a77204cc2/\u003chostname\u003e/\u003cusername\u003e, transmitting installer host identifiers to a third-party inspection endpoint. The package name uses a scope that resembles an internal/organization namespace and is published at version 99.9.9 — a version-number shape consistent with dependency-confusion beacons designed to win resolution against a private package of the same name. Installing this package causes any host that runs npm install (developer workstations, CI runners) to report its hostname and login user to the attacker-controlled collector, providing reconnaissance for follow-on targeting of the affected environments.\n","modified":"2026-09-24T13:30:05.099639460Z","published":"2026-09-24T13:15:58Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-09-24T13:15:58Z","sha256":"f6392dad6c7467b1d2b75c329d517982f061f3ca0792b8879b72127813d26aa8","source":"amazon-inspector","versions":["99.9.9"],"id":"IN-MAL-2026-020503","import_time":"2026-09-24T13:18:04.181697093Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@birbalo/aliftech-ui/v/99.9.9"}],"affected":[{"package":{"name":"@birbalo/aliftech-ui","ecosystem":"npm","purl":"pkg:npm/%40birbalo/aliftech-ui"},"versions":["99.9.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@birbalo/aliftech-ui/MAL-2026-17153.json","indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"da89ffe92db45a0039edb7a241042688a4430f1b3858f0a199f54704319a5a4a","tlsh":"dee0d8f862f393341a7945c491415c0ada93912876a6c8c5da9812f1d6d2ab8ddd01b4"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-2VJzb+jBnAxzjQs4aWD5fVIJJUaQgxSebkldvkPG7pWeTERBzJSk11rJNLrevr05ncof371rq+lQwhT+JXq7Uw==","sha1":"f9b200a3f61c5193bc77e6b7d3bd2421c35af9b3"},"filename":"aliftech-ui-99.9.9.tgz"}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}