MAL-2026-5288

    Dashboard / Malicious Package / MAL-2026-5288

    MAL-2026-5288

    Published: 6 Jun 2026Last Modified: 11 Jun 2026

    Summary: Malicious code in uisp-connector (npm)

    Details: Source: amazon-inspector (351b32a85d024168970d1a2e8b7c9c5e6ff6f1d31191390f248a988d9ea6b9a9) package.json declares `preinstall: node index.js || true`, causing index.js to run automatically on `npm install`. index.js issues a DNS resolution and HTTPS GET to a unique subdomain under `oast.online` (an Interactsh out-of-band collection server). The callback reveals the installer's resolver IP, egress IP, and the fact that an internal build system fetched a package matching this name — the canonical dependency-confusion exfiltration signal. The README self-identifies the package as security research, and the version string contains `security-research`, but an installer cannot distinguish authorized research from real exploitation: the network beacon and information disclosure happen identically in both cases, and whoever controls the Interactsh subdomain receives the data. Source: ossf-package-analysis (7387d5655b4341cd75024769045f64a7a2e6315e948c9b2e9789c9704f48ecc7) The OpenSSF Package Analysis project identified 'uisp-connector' @ 99.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

    References: https://www.npmjs.com/package/uisp-connector/v/0.0.1-security-research, https://www.npmjs.com/package/uisp-connector/v/0.0.2-security-research

    Affected packages

    Package

    Name: uisp-connector

    Purl: pkg:npm/uisp-connector

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.0.0