{"id":"MAL-2026-16064","summary":"Malicious code in bx-ui-view (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ce3874d2c55544bbbf59b6a60c3002b13e242fb53160a455597b13fdd37231f8)\npackage.json declares a dependency whose key equals the package's own name (bx-ui-view) and whose value is a plain HTTPS URL (https://package-access.pages.dev/bx-ui-view) rather than a registry version range. On `npm install`, npm resolves this URL, downloads whatever tarball is served, and executes any lifecycle scripts inside it — with no version pin, no integrity check, and no hash/signature verification. The shipped index.js is a 3-line inert stub, so the manifest line is the entire published surface: the installer receives whatever content the operator of package-access.pages.dev chooses to serve at install time. The self-name + off-registry URL + stub source combination is the dependency-confusion / smuggled-payload shape, and the pages.dev host is unrelated to any registry or declared publisher domain.\n","modified":"2026-09-09T02:00:04.575342516Z","published":"2026-09-09T01:41:04Z","database_specific":{"malicious-packages-origins":[{"sha256":"ce3874d2c55544bbbf59b6a60c3002b13e242fb53160a455597b13fdd37231f8","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-019746","import_time":"2026-09-09T01:51:48.735364847Z","modified_time":"2026-09-09T01:41:04Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bx-ui-view/v/1.0.0"}],"affected":[{"package":{"name":"bx-ui-view","ecosystem":"npm","purl":"pkg:npm/bx-ui-view"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"hashes":{"sha1":"1f04f1ce64472603d8d8f338aae0e15bf0a1f6e8","sha512_sri":"sha512-wvFPMeCMmM+lDunyDXikMuSMtc5xqyzoJTOEmo0Vf6gUeI8qpq6OmpU3/qonPWF7ilNJh8klqullVxRmZvVU5A=="},"filename":"bx-ui-view-1.0.0.tgz"}],"evidence_files":[{"path":"package.json","sha256":"fc64b51a02331204f352df35519901b985129d6a36b78d2673feb6626ab3b63a","tlsh":"08e0263045a42caf61c41161e83a680b73328e3f020c3c0463cb8c2c439e1bb58fe31c"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bx-ui-view/MAL-2026-16064.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}