Malicious code in @birbalo/aliftech-ui (npm)
Historical advisory saved 24 Oct 2026 13:17:17 UTC. The publisher may have updated it since then. Latest advisory.
osv · MAL-2026-17153
Published--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f6392dad6c7467b1d2b75c329d517982f061f3ca0792b8879b72127813d26aa8) The npm package @birbalo/[email protected] ships a postinstall.js lifecycle script that runs automatically on npm install. The script imports the built-in os and https modules, reads os.hostname() and os.userInfo().username, and issues an HTTPS GET to https://webhook.site/539f8bb9-497a-4104-92f7-f95a77204cc2/<hostname>/<username>, transmitting installer host identifiers to a third-party inspection endpoint. The package name uses a scope that resembles an internal/organization namespace and is published at version 99.9.9 — a version-number shape consistent with dependency-confusion beacons designed to win resolution against a private package of the same name. Installing this package causes any host that runs npm install (developer workstations, CI runners) to report its hostname and login user to the attacker-controlled collector, providing reconnaissance for follow-on targeting of the affected environments.
- Source published
- 24 Sep 2026 13:15:58 UTC
- Source modified
- 24 Sep 2026 13:30:05 UTC
- Saved here
- 24 Oct 2026 13:17:17 UTC
- Source terms
- OSV · upstream source license applies
Original source record · Cite this exact observation · Complete original publisher JSON
Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.