MAL-2026-12054

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/uibabai/MAL-2026-12054.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12054
Published
2026-08-05T00:53:07Z
Modified
2026-08-05T01:49:57.824380458Z
Summary
Malicious code in uibabai (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2680f37e219fec8bf9af5b922534ccb483a6b0503d0158cccaa0c152ed6b7484)

index.js has malicious code appended after a legitimate Tailwind plugin export. On any require()/import of the package, the appended block queries the public Ethereum RPC eth.drpc.org for a transaction from the hardcoded address 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a, derives an IPv4 C2 endpoint from the first 4 bytes of the transaction's to field, fetches XOR-encrypted payloads over plain HTTP from paths /0x/cls and /0x/ls, and executes the decrypted bytes via eval and a spawned node -e child process. Identifiers such as require, http, https, child_process, POST, application/json, base64, and the eth_blockNumber/eth_getBlockByNumber RPC method names are hidden behind \uXXXX unicode escapes, and server responses are XOR-decoded before execution. The blockchain lookup functions as a dead-drop resolver so the C2 IP can be rotated by publishing a new Ethereum transaction without modifying the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T00:53:07Z",
            "sha256": "2680f37e219fec8bf9af5b922534ccb483a6b0503d0158cccaa0c152ed6b7484",
            "id": "IN-MAL-2026-011470",
            "versions": [
                "5.7.5"
            ],
            "import_time": "2026-08-05T01:39:30.445725675Z"
        }
    ]
}
References
Credits

Affected packages

npm / uibabai

Package

Name
uibabai
View open source insights on deps.dev
Purl
pkg:npm/uibabai

Affected ranges

Affected versions

5.*
5.7.5

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-7ie0bJQrMR3slGb3ldlhdAhMXywJFKhCVMwEIvM6JqdlB6BsE0+9Au2jlL0uQaUHzxUeQNatR60slrjYhY/CNg==",
                "sha1": "2859f7347901f24ce2b351560d302483f26f9e09"
            },
            "filename": "uibabai-5.7.5.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "d0369cd2d8794f3bda662118c69c8fc060fff88b638eca4d7faf839e8c0340fb",
            "tlsh": "c0c142b5937d9e1a81725818cc76680ee1b890933e6fe820bd2f34c9df5d3d497a2784"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/uibabai/MAL-2026-12054.json"