MAL-2026-16064

    Dashboard / Malicious Package / MAL-2026-16064

    MAL-2026-16064

    Published: 9 Sept 2026Last Modified: 9 Sept 2026

    Summary: Malicious code in bx-ui-view (npm)

    Details: Source: amazon-inspector (ce3874d2c55544bbbf59b6a60c3002b13e242fb53160a455597b13fdd37231f8) package.json declares a dependency whose key equals the package's own name (bx-ui-view) and whose value is a plain HTTPS URL (https://package-access.pages.dev/bx-ui-view) rather than a registry version range. On `npm install`, npm resolves this URL, downloads whatever tarball is served, and executes any lifecycle scripts inside it — with no version pin, no integrity check, and no hash/signature verification. The shipped index.js is a 3-line inert stub, so the manifest line is the entire published surface: the installer receives whatever content the operator of package-access.pages.dev chooses to serve at install time. The self-name + off-registry URL + stub source combination is the dependency-confusion / smuggled-payload shape, and the pages.dev host is unrelated to any registry or declared publisher domain.

    References: https://www.npmjs.com/package/bx-ui-view/v/1.0.0

    Affected packages

    Package

    Name: bx-ui-view

    Purl: pkg:npm/bx-ui-view

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0