Malicious code in dbk-ui-forms (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (36c6972ca0999559f2a4548843790c8000451acb4869da3c83d0357a655586ba) On `npm install`, the package's preinstall hook runs index.js which collects host identity (hostname, username, homedir, network interfaces, uid), output of `whoami`/`id`/`pwd`/`uname -a`, and the names of process.env variables matching a broad credential regex (key/token/secret/pass/auth/cred/npm/ci/build/jenkins/github/gitlab/aws/azure). The collected JSON is transmitted to the hardcoded Interactsh subdomain `ycwyyoimdcluajepubah2mvmkibt4h5wm.oast.fun` via HTTPS POST, HTTP POST, and DNS-encoded lookups. The package name and version (99.0.1) are consistent with a dependency-confusion beacon targeting internal build systems that resolve an unclaimed name from the public registry.
MAL-2026-12669
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-12669
dbk-ui-forms
Source reference: /affected/0/package/name
- Affected versions
- 99.0.1
Source reference:
/affected/0/versions99.0.0Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "dbk-ui-forms",
"purl": "pkg:npm/dbk-ui-forms",
"ecosystem": "npm"
},
"versions": [
"99.0.1",
"99.0.0"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dbk-ui-forms/MAL-2026-12669.json",
"indicators": {
"evidence_files": [
{
"path": "index.js",
"tlsh": "555141d253e866b139f299c1b4671b517297c2273a16fcd0b96c032e1f8ddb84173591",
"sha256": "e7f673a395d592b8760b4a378f97da60792b444d022619105728e0f2c15e9a71"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "86ad2a32e74945d171e02ebf0b71e382faa5af1d",
"sha512_sri": "sha512-dAiVpzYzt5A7MFwFBL5oePMUVlvoPCsW8yVoh92cM+7YD8kNWkkr5gnhxZLDPNuXN29jPIewpRCH8S3OfQZBvg=="
},
"filename": "dbk-ui-forms-99.0.1.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #10968 · Revision 1
- Added to Heist Feed
- Publisher date