MAL-2026-16321

    Dashboard / Malicious Package / MAL-2026-16321

    MAL-2026-16321

    Published: 21 Sept 2026Last Modified: 21 Sept 2026

    Summary: Malicious code in @siriusbeyond/ui (npm)

    Details: Source: amazon-inspector (3d81713c34940a8d3511a53c6cb8001481734bc2493be23d0f6ddb1dd561fa72) On npm install, both preinstall and postinstall lifecycle hooks execute callback.js, which collects installer host identity (hostname, username, platform, cwd, home directory, UID, CI/cloud indicators, npm registry) and enumerates the names of environment variables matching credential-shaped patterns (token, secret, key, password, auth, api, aws, azure, npm, git, docker, registry, artifactory, nexus, credential), then POSTs the collected data to api.telegram.org via a hardcoded bot token and chat id (1064260758) using https.request to /bot<token>/sendMessage. The lifecycle commands are wrapped in `2>/dev/null || true` to suppress errors and hide the exfil from the installer during `npm install`. A README framing this as a dependency-confusion proof of concept does not change the behavior: the package auto-executes credential-context reconnaissance and host fingerprinting against installer machines and transmits the results to an attacker-controlled Telegram channel.

    References: https://www.npmjs.com/package/@siriusbeyond/ui/v/99.0.0

    Affected packages

    Package

    Name: @siriusbeyond/ui

    Purl: pkg:npm/%40siriusbeyond/ui

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.0.0