jquery.ui.core

Details

**Severity:** Critical

**Affected versions:** `= 9999.0.0`

## Source: amazon-inspector (0fe5bc94d3ac40b31064d4dad8125dc959fdc3559785cdbeb03de2cc16c147ac)
Package is a dependency-confusion squat on the jquery.ui.core name published at version 9999.0.0. The main entry (index.js) is empty (module.exports = {}); the only functional code is a preinstall script (callback.js) that runs automatically on npm install. On install, the script reads os.hostname(), os.userInfo().username, process.cwd(), npm_config_registry, and CI repository-identifier environment variables (GITHUB_REPOSITORY, CI_PROJECT_PATH, BUILD_REPOSITORY_NAME, BITBUCKET_REPO_FULL_NAME, TRAVIS_REPO_SLUG, DRONE_REPO, BUILDKITE_PIPELINE_SLUG, CIRCLE_PROJECT_REPONAME, JOB_NAME) and issues an HTTP GET to http://75.119.137.232:31337/depconfuse with those values as query parameters. The 9999.0.0 version, empty module body, hardcoded bare-IP over plaintext HTTP, and reporting of the configured npm registry plus CI repo slug are the canonical dependency-confusion reconnaissance shape used to identify internal build systems that mistakenly resolved a private package name to the public registry.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/ce5aebcf135d19fafa94c24995d7ad8fac9d024d/osv/malicious/npm/jquery.ui.core/MAL-2026-12394.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/ce5aebcf135d19fafa94c24995d7ad8fac9d024d/osv/malicious/npm/jquery.ui.core/MAL-2026-12394.json
- https://www.npmjs.com/package/jquery.ui.core/v/9999.0.0
- https://github.com/advisories/GHSA-mmvm-7jhq-mgj8

Compromised versions (1)

• = 9999.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.