@convera/ui-shared

Details

**Severity:** Critical

**Affected versions:** `= 0.0.2`

## Source: amazon-inspector (3fa0960816c1204042cecc61c5337e5db2c1407f5325cfc2ed26e43b5dc054d0)
On `npm install`, the package's `preinstall.js` collects `os.hostname()` and `os.userInfo().username` and sends them as query parameters (`/?hn=<hostname>&un=<username>`) via `https.request` to `am0f14nl6o1nqwrngbrq33amfdl496xv.oastify.com`, a Burp Collaborator subdomain. The package ships an empty `index.js` (`module.exports = {}`) and a `package.json` description identifying itself as a 'bug-bounty research placeholder — Convera', published under the `@convera/*` scope to match a private internal namespace. Any installer who resolves this name (accidental scope resolution, misconfigured registry, or a legitimate Convera dev pulling the public registry version) silently leaks host identifiers to a third-party Collaborator endpoint with no opt-in and no functional code in return. Regardless of the author's stated research intent, this is unauthorized data collection from every installer and a dependency-confusion attack surface against the Convera organization.

## Source: ossf-package-analysis (647502d33492bf942a8b0bd468f7420ebca797820c7a47ac74c238c35ae08bff)
The OpenSSF Package Analysis project identified '@convera/ui-shared' @ 0.0.2 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/0b5cc7711b07443690db456cabe97730dd6202f4/osv/malicious/npm/@convera/ui-shared/MAL-2026-3724.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/0b5cc7711b07443690db456cabe97730dd6202f4/osv/malicious/npm/@convera/ui-shared/MAL-2026-3724.json
- https://www.npmjs.com/package/@convera/ui-shared/v/0.0.2
- https://www.npmjs.com/package/@convera/ui-shared/v/0.0.3
- https://github.com/advisories/GHSA-5gr4-vr9v-phc3

Compromised versions (1)

• = 0.0.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.