MAL-2026-10615

    Dashboard / Malicious Package / MAL-2026-10615

    MAL-2026-10615

    Published: 14 Jul 2026Last Modified: 14 Jul 2026

    Summary: Malicious code in smb-common-uikit (npm)

    Details: Source: amazon-inspector (66072ca2fc20c19a01d0a2b888d90632a7d9bfdc34a2d1a71b61ad06975eae5c) package.json declares a preinstall hook that runs index.js. On npm install, index.js collects host reconnaissance from the installer (os.hostname(), os.userInfo(), os.platform(), os.arch(), homedir, uid/gid, shell, plus the output of `whoami`, `id`, and cwd via child_process) and POSTs the resulting JSON to the hardcoded URL https://rmh3j781pdp9ysnwutndo1ftjkpbd31s.oastify.com/detox56. oastify.com is a Burp Suite Collaborator out-of-band interaction domain, and the unique random subdomain plus install-time host beacon is the canonical dependency-confusion / reconnaissance exfiltration shape.

    References: https://www.npmjs.com/package/smb-common-uikit/v/15.2.0

    Affected packages

    Package

    Name: smb-common-uikit

    Purl: pkg:npm/smb-common-uikit

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    15.2.0
    MAL-2026-10615 | CVE-DB