MAL-2026-12054

    Dashboard / Malicious Package / MAL-2026-12054

    MAL-2026-12054

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in uibabai (npm)

    Details: Source: amazon-inspector (2680f37e219fec8bf9af5b922534ccb483a6b0503d0158cccaa0c152ed6b7484) index.js has malicious code appended after a legitimate Tailwind plugin export. On any require()/import of the package, the appended block queries the public Ethereum RPC eth.drpc.org for a transaction from the hardcoded address 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a, derives an IPv4 C2 endpoint from the first 4 bytes of the transaction's `to` field, fetches XOR-encrypted payloads over plain HTTP from paths /0x/cls and /0x/ls, and executes the decrypted bytes via `eval` and a spawned `node -e` child process. Identifiers such as `require`, `http`, `https`, `child_process`, `POST`, `application/json`, `base64`, and the `eth_blockNumber`/`eth_getBlockByNumber` RPC method names are hidden behind `\uXXXX` unicode escapes, and server responses are XOR-decoded before execution. The blockchain lookup functions as a dead-drop resolver so the C2 IP can be rotated by publishing a new Ethereum transaction without modifying the package.

    References: https://www.npmjs.com/package/uibabai/v/5.7.5

    Affected packages

    Package

    Name: uibabai

    Purl: pkg:npm/uibabai

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    5.7.5