Malicious code in electrode-ota-ui-app (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (6b9fb0d73b7d26454a227e93754f11ff2405424b1279490863055e8d8c8c6498) Package targets the electrode-io internal name `electrode-ota-ui-app` with an inflated 99.0.1 version to win dependency resolution against a private registry. package.json declares both `main: index.js` and `scripts.postinstall: node index.js`, so on `npm install` and on any `require()` the package unconditionally runs `collectAndSend()` in index.js. That function gathers host identifiers via `os.hostname()`, `os.userInfo()`, `os.platform()`, and `os.release()`, resolves the installer's public IP via ipify and geo/ISP data via ipapi.co, and POSTs a JSON payload to the hardcoded Burp Collaborator subdomain `https://itfv50wbocctx0j32fyfq8z7uy0ptdn1c.oastify.com/callback`, controlled by the package author. README self-labels as a dependency-confusion PoC, but the callback is live and any installer whose resolver picks this public package over the intended internal one is compromised.
MAL-2026-12368
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-12368
electrode-ota-ui-app
Source reference: /affected/0/package/name
- Affected versions
- 99.0.1
Source reference:
/affected/0/versions99.0.0Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "electrode-ota-ui-app",
"purl": "pkg:npm/electrode-ota-ui-app",
"ecosystem": "npm"
},
"versions": [
"99.0.1",
"99.0.0"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/electrode-ota-ui-app/MAL-2026-12368.json",
"indicators": {
"evidence_files": [
{
"path": "index.js",
"tlsh": "d971ffba15f5523476f3e29dc60b82012112f1473e45ae69798c33905fcd62a63b27f9",
"sha256": "fde8a46daff69f5a26679e3181413871cbe2e8df62ac807439ee8398aaa40f89"
},
{
"path": "README.md",
"tlsh": "1ae06159eb45f365091f06eff06075b55135a05ae0ae45c0a14c48fad807695151e11f",
"sha256": "1851a185b9ad284f1227a2d49f2c46d2b66a4ebcdf16d7ad67ed695ee9ea77ae"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "9bc5f2833bb5cd0dd45521325487bb50933287d0",
"sha512_sri": "sha512-yUkqBrnBAwEvHy1SnXp82PxvHZXZIxuPqYyzk7DMfgzMnudOXbPtPuytKKcCEFSTlKysfpmNqtP504f3kA3GFg=="
},
"filename": "electrode-ota-ui-app-99.0.1.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #10966 · Revision 1
- Added to Heist Feed
- Publisher date