MAL-2026-10605

    Dashboard / Malicious Package / MAL-2026-10605

    MAL-2026-10605

    Published: 14 Jul 2026Last Modified: 14 Jul 2026

    Summary: Malicious code in @radivi-ui/react-dialog (npm)

    Details: Source: amazon-inspector (b5e92ae03eb6adb090fb832665431984cccef31039bb920e3850535f4defe610) @radivi-ui/react-dialog is a typosquat of @radix-ui/react-dialog whose main entry (index.js) is a self-executing IIFE that runs `whoami` and `hostname` via `child_process.execSync` when the package is loaded via require/import. The command outputs are hex-encoded and exfiltrated to the hardcoded Burp Collaborator subdomain `vih2vewj1xxwlsd8dkgjqugtyk4bs1gq.oastify.com` via both DNS resolution (dns.resolve of a crafted subdomain) and HTTP GET (http.get). The behavior fires unconditionally on module load with no user opt-in, no CLI gate, and no relation to any dialog/UI functionality the package name implies.

    References: https://www.npmjs.com/package/@radivi-ui/react-dialog/v/1.1.3, https://www.npmjs.com/package/@radivi-ui/react-dialog/v/1.1.4

    Affected packages

    Package

    Name: @radivi-ui/react-dialog

    Purl: pkg:npm/%40radivi-ui/react-dialog

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.1.3
    1.1.4
    MAL-2026-10605 | CVE-DB