Malicious code in aliftech-ui (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (e61479316af4cfc0884dfe88744a0ed14fa64e052471cc216667c80502689860) postinstall.js runs automatically on npm install and reads os.hostname() and os.userInfo().username, then issues an https.get to a hardcoded webhook.site collector URL (https://webhook.site/539f8bb9-497a-4104-92f7-f95a77204cc2//), embedding the installer identifiers in the URL path. The package name mimics an organization prefix and is published at version 99.9.9, a shape consistent with dependency-confusion targeting of an internal package name; installing it causes any resolving build (including CI) to beacon identifying host and account data to an anonymous third-party collector.
MAL-2026-17156
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17156
aliftech-ui
Source reference: /affected/0/package/name
- Affected versions
- 99.9.9
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "aliftech-ui",
"purl": "pkg:npm/aliftech-ui",
"ecosystem": "npm"
},
"versions": [
"99.9.9"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/aliftech-ui/MAL-2026-17156.json",
"indicators": {
"evidence_files": [
{
"path": "postinstall.js",
"tlsh": "dee0d8f862f393341a7945c491415c0ada93912876a6c8c5da9812f1d6d2ab8ddd01b4",
"sha256": "da89ffe92db45a0039edb7a241042688a4430f1b3858f0a199f54704319a5a4a"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "abd61dfb233d75bea5d06ec24535206ad50549f7",
"sha512_sri": "sha512-6a/dxc5w9LDrMiwiWBGvbm5rUSEJOQcNBzik/1ZvGBCsDFw/De3FepSn2P5dEILfG07b0MPoB/pTfbvOs4m0Ww=="
},
"filename": "aliftech-ui-99.9.9.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #13785 · Revision 1
- Added to Heist Feed
- Publisher date