MAL-2026-17153

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@birbalo/aliftech-ui/MAL-2026-17153.json
JSON Data
https://api.test.osv.dev/v1/vulns/MAL-2026-17153
Published
2026-09-24T13:15:58Z
Modified
2026-09-24T13:30:05Z
Summary
Malicious code in @birbalo/aliftech-ui (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f6392dad6c7467b1d2b75c329d517982f061f3ca0792b8879b72127813d26aa8)

The npm package @birbalo/aliftech-ui@99.9.9 ships a postinstall.js lifecycle script that runs automatically on npm install. The script imports the built-in os and https modules, reads os.hostname() and os.userInfo().username, and issues an HTTPS GET to https://webhook.site/539f8bb9-497a-4104-92f7-f95a77204cc2//, transmitting installer host identifiers to a third-party inspection endpoint. The package name uses a scope that resembles an internal/organization namespace and is published at version 99.9.9 — a version-number shape consistent with dependency-confusion beacons designed to win resolution against a private package of the same name. Installing this package causes any host that runs npm install (developer workstations, CI runners) to report its hostname and login user to the attacker-controlled collector, providing reconnaissance for follow-on targeting of the affected environments.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020503",
            "import_time":  "2026-09-24T13:18:04.181697093Z",
            "modified_time":  "2026-09-24T13:15:58Z",
            "sha256":  "f6392dad6c7467b1d2b75c329d517982f061f3ca0792b8879b72127813d26aa8",
            "source":  "amazon-inspector",
            "versions":  [
                "99.9.9"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @birbalo/aliftech-ui

Package

Name
@birbalo/aliftech-ui
View open source insights on deps.dev
Purl
pkg:npm/%40birbalo/aliftech-ui

Affected ranges

Affected versions

99.*
99.9.9

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "postinstall.js",
            "sha256":  "da89ffe92db45a0039edb7a241042688a4430f1b3858f0a199f54704319a5a4a",
            "tlsh":  "dee0d8f862f393341a7945c491415c0ada93912876a6c8c5da9812f1d6d2ab8ddd01b4"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "aliftech-ui-99.9.9.tgz",
            "hashes":  {
                "sha1":  "f9b200a3f61c5193bc77e6b7d3bd2421c35af9b3",
                "sha512_sri":  "sha512-2VJzb+jBnAxzjQs4aWD5fVIJJUaQgxSebkldvkPG7pWeTERBzJSk11rJNLrevr05ncof371rq+lQwhT+JXq7Uw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@birbalo/aliftech-ui/MAL-2026-17153.json"