MAL-2026-12395

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/jquery.ui.tabs/MAL-2026-12395.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12395
Published
2026-08-05T13:05:29Z
Modified
2026-08-05T13:35:34.265435241Z
Summary
Malicious code in jquery.ui.tabs (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (50fc48e6d03705244cf78a2f2ee23c6ffe5a91a64f98d23d6a31f94557bf0d84)

jquery.ui.tabs@9999.0.0 is a dependency-confusion squat: it is published at version 9999.0.0 with an empty runtime (index.js contains only module.exports = {}) and a preinstall lifecycle hook that runs node callback.js. On npm install, the preinstall script collects os.hostname(), os.userInfo().username, process.cwd(), npm_config_registry, and a sweep of CI repository-identifier environment variables (GitHub, GitLab, Azure, Bitbucket, Travis, Drone, Buildkite, Circle, Jenkins) and sends them as query-string parameters over plain HTTP to the hardcoded bare-IP endpoint http://75.119.137.232:31337/depconfuse. The 9999.0.0 version and empty main are consistent with a probe designed to outrank an internal jquery.ui.tabs package in mixed registry resolution and report back which organizations resolve the public name, exposing internal hostnames, usernames, working directories, and private repository slugs to an attacker-controlled host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "50fc48e6d03705244cf78a2f2ee23c6ffe5a91a64f98d23d6a31f94557bf0d84",
            "source": "amazon-inspector",
            "versions": [
                "9999.0.0"
            ],
            "import_time": "2026-08-05T13:08:52.603541643Z",
            "modified_time": "2026-08-05T13:05:29Z",
            "id": "IN-MAL-2026-014878"
        }
    ]
}
References
Credits

Affected packages

npm / jquery.ui.tabs

Package

Name
jquery.ui.tabs
View open source insights on deps.dev
Purl
pkg:npm/jquery.ui.tabs

Affected ranges

Affected versions

9999.*
9999.0.0

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "8388f21713889797a7de8817c4dd6b59244d87f2",
                "sha512_sri": "sha512-XG1sJa2grN7cdy2YvQN+dY1ho8wdK5B7+Xv8+r8qUKqUs/tXo4obh3tV//u6A4/YcwkqyD/iXsx/vDmOR1RJUw=="
            },
            "filename": "jquery.ui.tabs-9999.0.0.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "callback.js",
            "sha256": "5ccd3bf1db0172f252cdfd3b160166e2f8f239f605763837796962fcca0a52bf",
            "tlsh": "0a119eb9c68c0d3409c2178479686c5eb8fbe29233c294917f2d71d26bb227046b75fd"
        },
        {
            "path": "package.json",
            "sha256": "624ff5e65eefdb362b0f74243ac76a458aa69ed9ed018ba419af6e0199b4342f",
            "tlsh": "4ed09730da2248233cd8ffd30c2a058600378f2b01087c092787901d45aca6728ff28d"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/jquery.ui.tabs/MAL-2026-12395.json"