MAL-2026-5831

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/unicocheck-ios/MAL-2026-5831.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-5831
Published
2026-06-15T11:36:27Z
Modified
2026-06-16T06:01:49Z
Summary
Malicious code in unicocheck-ios (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (bafc91c569cf42c5f1ff68531a8d5238919f595368ffa90b7d4e5bcc74fe9788)

package.json declares a preinstall lifecycle script that runs curl against https://webhook.site/fe1246c2-ac04-4493-b223-fe34ba26b79f with query parameters carrying the installer's hostname, username ($(whoami)), current working directory, OS uname output, and HOME path. This fires automatically on npm install before any user code runs, leaking host identifiers and environment context to a third-party webhook capture endpoint controlled by the publisher. The package metadata (name unicocheck-ios, description Unico Check iOS SDK - biometric identity verification, version 9.9.9) impersonates the Unico vendor's iOS SDK and uses the canonical dependency-confusion sentinel version, indicating the package is positioned to win resolution against an internal package name and harvest data from build environments that mistakenly fetch it from the public registry.

Source: ossf-package-analysis (05ebccc546e1450dad339a76440193233639cd77d9a761ae76f1db67e0e2be7b)

The OpenSSF Package Analysis project identified 'unicocheck-ios' @ 9.9.9 (npm) as malicious.

It is considered malicious because:

  • The package executes one or more commands associated with malicious behavior.
Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-006696",
            "import_time": "2026-06-15T20:14:28.838806956Z",
            "modified_time": "2026-06-15T19:59:10Z",
            "sha256": "bafc91c569cf42c5f1ff68531a8d5238919f595368ffa90b7d4e5bcc74fe9788",
            "source": "amazon-inspector",
            "versions": [
                "9.9.9"
            ]
        },
        {
            "import_time": "2026-06-16T05:56:18.391441684Z",
            "modified_time": "2026-06-15T11:36:27Z",
            "sha256": "05ebccc546e1450dad339a76440193233639cd77d9a761ae76f1db67e0e2be7b",
            "source": "ossf-package-analysis",
            "versions": [
                "9.9.9"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / unicocheck-ios

Package

Name
unicocheck-ios
View open source insights on deps.dev
Purl
pkg:npm/unicocheck-ios

Affected ranges

Affected versions

9.*
9.9.9

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "19536040ef2ed95a4f19b203c8ea0c986959dfe9b2c8e7d0e2cd4c8fb7e97131",
            "tlsh": "61e060f28e00e22037c60852bd105485ff616f0f3a243d9cbfc38220808c2b9500371c"
        }
    ],
    "package_integrity": [
        {
            "filename": "unicocheck-ios-9.9.9.tgz",
            "hashes": {
                "sha1": "e4edbc59cac51ed81e9634180de8d95dd8cf4d4b",
                "sha512_sri": "sha256-4ir0RBtgJ184VWk0hlj6yo2a9nDMlWUIU5dtUL3+qCc="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/unicocheck-ios/MAL-2026-5831.json"