MAL-2026-16064

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bx-ui-view/MAL-2026-16064.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16064
Published
2026-09-09T01:41:04Z
Modified
2026-09-09T02:00:04Z
Summary
Malicious code in bx-ui-view (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ce3874d2c55544bbbf59b6a60c3002b13e242fb53160a455597b13fdd37231f8)

package.json declares a dependency whose key equals the package's own name (bx-ui-view) and whose value is a plain HTTPS URL (https://package-access.pages.dev/bx-ui-view) rather than a registry version range. On npm install, npm resolves this URL, downloads whatever tarball is served, and executes any lifecycle scripts inside it — with no version pin, no integrity check, and no hash/signature verification. The shipped index.js is a 3-line inert stub, so the manifest line is the entire published surface: the installer receives whatever content the operator of package-access.pages.dev chooses to serve at install time. The self-name + off-registry URL + stub source combination is the dependency-confusion / smuggled-payload shape, and the pages.dev host is unrelated to any registry or declared publisher domain.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019746",
            "import_time": "2026-09-09T01:51:48.735364847Z",
            "modified_time": "2026-09-09T01:41:04Z",
            "sha256": "ce3874d2c55544bbbf59b6a60c3002b13e242fb53160a455597b13fdd37231f8",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bx-ui-view

Package

Name
bx-ui-view
View open source insights on deps.dev
Purl
pkg:npm/bx-ui-view

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "fc64b51a02331204f352df35519901b985129d6a36b78d2673feb6626ab3b63a",
            "tlsh": "08e0263045a42caf61c41161e83a680b73328e3f020c3c0463cb8c2c439e1bb58fe31c"
        }
    ],
    "package_integrity": [
        {
            "filename": "bx-ui-view-1.0.0.tgz",
            "hashes": {
                "sha1": "1f04f1ce64472603d8d8f338aae0e15bf0a1f6e8",
                "sha512_sri": "sha512-wvFPMeCMmM+lDunyDXikMuSMtc5xqyzoJTOEmo0Vf6gUeI8qpq6OmpU3/qonPWF7ilNJh8klqullVxRmZvVU5A=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bx-ui-view/MAL-2026-16064.json"