MAL-2026-17153

    Dashboard / Malicious Package / MAL-2026-17153

    MAL-2026-17153

    Published: 24 Sept 2026Last Modified: 24 Sept 2026

    Summary: Malicious code in @birbalo/aliftech-ui (npm)

    Details: Source: amazon-inspector (f6392dad6c7467b1d2b75c329d517982f061f3ca0792b8879b72127813d26aa8) The npm package @birbalo/[email protected] ships a postinstall.js lifecycle script that runs automatically on npm install. The script imports the built-in os and https modules, reads os.hostname() and os.userInfo().username, and issues an HTTPS GET to https://webhook.site/539f8bb9-497a-4104-92f7-f95a77204cc2/<hostname>/<username>, transmitting installer host identifiers to a third-party inspection endpoint. The package name uses a scope that resembles an internal/organization namespace and is published at version 99.9.9 — a version-number shape consistent with dependency-confusion beacons designed to win resolution against a private package of the same name. Installing this package causes any host that runs npm install (developer workstations, CI runners) to report its hostname and login user to the attacker-controlled collector, providing reconnaissance for follow-on targeting of the affected environments.

    References: https://www.npmjs.com/package/@birbalo/aliftech-ui/v/99.9.9

    Affected packages

    Package

    Name: @birbalo/aliftech-ui

    Purl: pkg:npm/%40birbalo/aliftech-ui

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.9.9