MAL-2026-16321

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@siriusbeyond/ui/MAL-2026-16321.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16321
Published
2026-09-21T03:28:50Z
Modified
2026-09-21T04:00:05Z
Summary
Malicious code in @siriusbeyond/ui (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3d81713c34940a8d3511a53c6cb8001481734bc2493be23d0f6ddb1dd561fa72)

On npm install, both preinstall and postinstall lifecycle hooks execute callback.js, which collects installer host identity (hostname, username, platform, cwd, home directory, UID, CI/cloud indicators, npm registry) and enumerates the names of environment variables matching credential-shaped patterns (token, secret, key, password, auth, api, aws, azure, npm, git, docker, registry, artifactory, nexus, credential), then POSTs the collected data to api.telegram.org via a hardcoded bot token and chat id (1064260758) using https.request to /bot/sendMessage. The lifecycle commands are wrapped in 2>/dev/null || true to suppress errors and hide the exfil from the installer during npm install. A README framing this as a dependency-confusion proof of concept does not change the behavior: the package auto-executes credential-context reconnaissance and host fingerprinting against installer machines and transmits the results to an attacker-controlled Telegram channel.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-020218",
            "import_time": "2026-09-21T03:46:36.882182639Z",
            "modified_time": "2026-09-21T03:28:50Z",
            "sha256": "3d81713c34940a8d3511a53c6cb8001481734bc2493be23d0f6ddb1dd561fa72",
            "source": "amazon-inspector",
            "versions": [
                "99.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @siriusbeyond/ui

Package

Name
@siriusbeyond/ui
View open source insights on deps.dev
Purl
pkg:npm/%40siriusbeyond/ui

Affected ranges

Affected versions

99.*
99.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "callback.js",
            "sha256": "92acd9d29ba169e07719394d8c8a097a29cd548d4fa5f3afa38a9c953675e90d",
            "tlsh": "ca71e7c852ebd5221be116d76559bc036946e0073f0db1623a1c53906fc896d87727ff"
        },
        {
            "path": "package.json",
            "sha256": "8dfa458e92382a947a46245bfab4ae8f1e631f6cb417d84290317b99959486af",
            "tlsh": "48e0f1646e180b233decced82435c60190399d0f0cac782513b3498842ce7634a7d3bf"
        }
    ],
    "package_integrity": [
        {
            "filename": "ui-99.0.0.tgz",
            "hashes": {
                "sha1": "9bc4a21b558cee2366c73bfba314bed082abfac9",
                "sha512_sri": "sha512-17f5JMdWC9/efwLuZp5SdMkkHUatz0Faw7ORIzkmnimX+dhiXLT2C/1NE7/GPWWCB8wIZ6/C2uP/8LVO62WPhg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@siriusbeyond/ui/MAL-2026-16321.json"