MAL-2026-16319

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@dbbhk/ui-components/MAL-2026-16319.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16319
Published
2026-09-21T03:28:30Z
Modified
2026-09-21T04:00:05Z
Summary
Malicious code in @dbbhk/ui-components (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (478839dda68d2c5eefa1a55557602d4b12396c988211b28d785af531d0b19d07)

@dbbhk/ui-components@99.0.0 declares both preinstall and postinstall hooks in package.json that execute node callback.js, so the payload runs automatically on npm install. callback.js queries the AWS instance metadata service at 169.254.169.254 for IAM role credentials, reads ECS task-role credentials via AWS_CONTAINER_CREDENTIALS_RELATIVE_URI, iterates process.env harvesting variables matching AWS/SECRET/KEY/TOKEN/PASSWORD/CREDENTIAL/AUTH/API/NPM/GITHUB/GITLAB patterns, and reads credential files including ~/.aws/credentials, /root/.aws/credentials, ~/.npmrc,.env,.npmrc, and the Kubernetes service-account token at /var/run/secrets/kubernetes.io/serviceaccount/token. It also collects host reconnaissance (hostname, whoami, id, platform, cwd, home directory, and CI-provider fingerprint for GitHub Actions/GitLab/Jenkins). Collected data is POSTed via https.request to api.telegram.org/bot/sendMessage against a hardcoded Telegram bot and chat id 1064260758. The package name and scope impersonate an HSBC internal component (dependency-confusion shape with an implausibly high 99.0.0 version), and a header comment self-labels the file as an HSBC bug-bounty PoC; the code performs indiscriminate credential harvesting on any installer regardless of that framing.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-020216",
            "import_time": "2026-09-21T03:46:36.712698803Z",
            "modified_time": "2026-09-21T03:28:30Z",
            "sha256": "478839dda68d2c5eefa1a55557602d4b12396c988211b28d785af531d0b19d07",
            "source": "amazon-inspector",
            "versions": [
                "99.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @dbbhk/ui-components

Package

Name
@dbbhk/ui-components
View open source insights on deps.dev
Purl
pkg:npm/%40dbbhk/ui-components

Affected ranges

Affected versions

99.*
99.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "callback.js",
            "sha256": "1c8c7ef24ca7ebacbea5db5e4855e452ed4116deb6a5162dfc23f7cfedec4d9d",
            "tlsh": "17f1547c61f274103a9b95fea79fa1017037f0033984da96baec42519f4689cc5e3ae9"
        }
    ],
    "package_integrity": [
        {
            "filename": "ui-components-99.0.0.tgz",
            "hashes": {
                "sha1": "d7a62a450fbcdfdb2558f9fc0c9cbede98763c6f",
                "sha512_sri": "sha512-J5flbO3ZwhP05x7L33LZ8QZfvWj+OP1o0Za1F5hQjPGx4X8OChGPq6O79+M3L0JCgJwzr5U762G7FlW8j9MaXA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@dbbhk/ui-components/MAL-2026-16319.json"