{"id":"MAL-2026-17153","revision":"7d0d86bd640543ce8b3a412f362e418b","records":[{"revision":"7d0d86bd640543ce8b3a412f362e418b","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17153","aliases":[],"title":"Malicious code in @birbalo/aliftech-ui (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f6392dad6c7467b1d2b75c329d517982f061f3ca0792b8879b72127813d26aa8)\nThe npm package @birbalo/aliftech-ui@99.9.9 ships a postinstall.js lifecycle script that runs automatically on npm install. The script imports the built-in os and https modules, reads os.hostname() and os.userInfo().username, and issues an HTTPS GET to https://webhook.site/539f8bb9-497a-4104-92f7-f95a77204cc2/<hostname>/<username>, transmitting installer host identifiers to a third-party inspection endpoint. The package name uses a scope that resembles an internal/organization namespace and is published at version 99.9.9 — a version-number shape consistent with dependency-confusion beacons designed to win resolution against a private package of the same name. Installing this package causes any host that runs npm install (developer workstations, CI runners) to report its hostname and login user to the attacker-controlled collector, providing reconnaissance for follow-on targeting of the affected environments.\n","state":0,"publishedAt":"2026-09-24T13:15:58+00:00","modifiedAt":"2026-09-24T13:30:05.1632041+00:00","affected":[{"ecosystem":"npm","name":"@birbalo/aliftech-ui","ranges":[],"versions":["99.9.9"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/@birbalo/aliftech-ui/v/99.9.9"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17153","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17153","identifiers":["MAL-2026-17153"]},"retained":false,"historicalAffected":[]}],"coverage":[]}