{"id":"MAL-2026-3681","summary":"Malicious code in @catamania/ui-components (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (326cc4cf1fbe96c77b6340df59ebea040cdd522e3e4bc76471563190044cf53a)\nThe package declares a postinstall lifecycle hook (`\"postinstall\": \"node postinstall.js\"` in package.json) that runs automatically during `npm install`. postinstall.js (lines 1-22) collects `os.hostname()`, `os.userInfo().username`, `process.cwd()`, and the entire `process.env` object, JSON-serializes them, and POSTs the payload over HTTPS to `attacker.appsec.cc:9999/exfiltrate`. On developer workstations and CI runners, `process.env` routinely contains high-value secrets (NPM_TOKEN, GITHUB_TOKEN, AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, CI provider tokens, database URLs). Errors are swallowed silently, a classic exfiltration-stealth technique. The package self-describes as internal UI components, which provides no legitimate justification for reading or transmitting environment variables. This is an unambiguous credential-theft supply-chain attack against the installer.\n","modified":"2026-05-13T20:18:48.513381Z","published":"2026-05-12T07:44:27Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-05-12T19:03:07Z","sha256":"326cc4cf1fbe96c77b6340df59ebea040cdd522e3e4bc76471563190044cf53a","source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-002442","import_time":"2026-05-13T20:10:57.097743954Z"},{"id":"IN-MAL-2026-002443","import_time":"2026-05-13T20:10:57.14762113Z","modified_time":"2026-05-12T18:35:19Z","sha256":"c318ae20e084477c4fd6d3f8408e68d4a4d0596a365adf4efe2f94fb5c22aedb","source":"amazon-inspector","versions":["1.0.1"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@catamania/ui-components/v/1.0.1"}],"affected":[{"package":{"name":"@catamania/ui-components","ecosystem":"npm","purl":"pkg:npm/%40catamania/ui-components"},"versions":["1.0.1"],"database_specific":{"indicators":{"domains":["attacker.appsec.cc"],"evidence_files":[{"path":"postinstall.js","sha256":"67b38f0c558ee3252b546ec37c40eab872a6889f6a9f772fa6fc6127aba7e14e","tlsh":"23f050f453a2d7a10eb9a1c4e085ec1712b3d101760b68a0b6d443a86fcd6fc1872ce4"}],"package_integrity":[{"filename":"ui-components-1.0.1.tgz","hashes":{"sha1":"2f9ed9681a4b50dc9d0b64c81a1775b5e8aebbca","sha512_sri":"sha512-eUew8dlpi72Lot3kgp/ssVODcWHXgxN5JHYWWDkCQpJMtlJqYjPvSTPo9mQrxqOtpaQZO0ah9ldwWF7ScvFU4w=="}}],"urls":["https://attacker.appsec.cc:9999/exfiltrate"]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@catamania/ui-components/MAL-2026-3681.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"}]}