Skip to content
Heist/ feed
Unrated

Malicious code in @birbalo/aliftech-ui (npm)

Type: advisorySource: OSV1 source record

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f6392dad6c7467b1d2b75c329d517982f061f3ca0792b8879b72127813d26aa8) The npm package @birbalo/aliftech-ui@99.9.9 ships a postinstall.js lifecycle script that runs automatically on npm install. The script imports the built-in os and https modules, reads os.hostname() and os.userInfo().username, and issues an HTTPS GET to https://webhook.site/539f8bb9-497a-4104-92f7-f95a77204cc2//, transmitting installer host identifiers to a third-party inspection endpoint. The package name uses a scope that resembles an internal/organization namespace and is published at version 99.9.9 — a version-number shape consistent with dependency-confusion beacons designed to win resolution against a private package of the same name. Installing this package causes any host that runs npm install (developer workstations, CI runners) to report its hostname and login user to the attacker-controlled collector, providing reconnaissance for follow-on targeting of the affected environments.

Announced Source revision 1
Original source ↗

MAL-2026-17153

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:MAL-2026-17153

@birbalo/aliftech-ui

Source reference: /affected/0/package/name

Affected versions
99.9.9

Source reference: /affected/0/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "package": {
      "name": "@birbalo/aliftech-ui",
      "purl": "pkg:npm/%40birbalo/aliftech-ui",
      "ecosystem": "npm"
    },
    "versions": [
      "99.9.9"
    ],
    "database_specific": {
      "cwes": [
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        }
      ],
      "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@birbalo/aliftech-ui/MAL-2026-17153.json",
      "indicators": {
        "evidence_files": [
          {
            "path": "postinstall.js",
            "tlsh": "dee0d8f862f393341a7945c491415c0ada93912876a6c8c5da9812f1d6d2ab8ddd01b4",
            "sha256": "da89ffe92db45a0039edb7a241042688a4430f1b3858f0a199f54704319a5a4a"
          }
        ],
        "package_integrity": [
          {
            "hashes": {
              "sha1": "f9b200a3f61c5193bc77e6b7d3bd2421c35af9b3",
              "sha512_sri": "sha512-2VJzb+jBnAxzjQs4aWD5fVIJJUaQgxSebkldvkPG7pWeTERBzJSk11rJNLrevr05ncof371rq+lQwhT+JXq7Uw=="
            },
            "filename": "aliftech-ui-99.9.9.tgz"
          }
        ]
      }
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#13786 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement