MAL-2026-2824

    Dashboard / Malicious Package / MAL-2026-2824

    MAL-2026-2824

    Published: 11 Apr 2026Last Modified: 23 Apr 2026

    Summary: Malicious code in unisys-uka (npm)

    Details: Package is malware. Collects sensitive info, reads files, executes commands, and exfiltrates data to a remote server via postinstall script. Source: amazon-inspector (25745bb1be4d673e8e465091f55bfdad6ad5cd5740583fd9a9f38fd7dd3e5d57) The package unisys-uka was found to contain malicious code. Source: ossf-package-analysis (f587bf8cae0a6838cff256b7a3a34295dc751390dcb7a9807ce353aaea5218ff) The OpenSSF Package Analysis project identified 'unisys-uka' @ 99.99.1 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

    References: https://app.safedep.io/community/malysis/01KNZ9MMGH12PFS02193JM30HF

    Affected packages

    Package

    Name: unisys-uka

    Purl: pkg:npm/unisys-uka

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    99.99.1
    MAL-2026-2824 | CVE-DB