@siriusbeyond/ui

GHSA-vw2m-5qq2-7qwg

Malicious code in @siriusbeyond/ui (npm)

Details

**Severity:** Critical

**Affected versions:** `= 99.0.0`

## Source: amazon-inspector (3d81713c34940a8d3511a53c6cb8001481734bc2493be23d0f6ddb1dd561fa72)
On npm install, both preinstall and postinstall lifecycle hooks execute callback.js, which collects installer host identity (hostname, username, platform, cwd, home directory, UID, CI/cloud indicators, npm registry) and enumerates the names of environment variables matching credential-shaped patterns (token, secret, key, password, auth, api, aws, azure, npm, git, docker, registry, artifactory, nexus, credential), then POSTs the collected data to api.telegram.org via a hardcoded bot token and chat id (1064260758) using https.request to /bot<token>/sendMessage. The lifecycle commands are wrapped in `2>/dev/null || true` to suppress errors and hide the exfil from the installer during `npm install`. A README framing this as a dependency-confusion proof of concept does not change the behavior: the package auto-executes credential-context reconnaissance and host fingerprinting against installer machines and transmits the results to an attacker-controlled Telegram channel.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/af486be301974b4c4068b1c7baa77731f37fa05e/osv/malicious/npm/@siriusbeyond/ui/MAL-2026-16321.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/af486be301974b4c4068b1c7baa77731f37fa05e/osv/malicious/npm/@siriusbeyond/ui/MAL-2026-16321.json
- https://www.npmjs.com/package/@siriusbeyond/ui/v/99.0.0
- https://github.com/advisories/GHSA-vw2m-5qq2-7qwg

Compromised versions (1)

= 99.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.