{"id":"MAL-2026-5288","summary":"Malicious code in uisp-connector (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (351b32a85d024168970d1a2e8b7c9c5e6ff6f1d31191390f248a988d9ea6b9a9)\npackage.json declares `preinstall: node index.js || true`, causing index.js to run automatically on `npm install`. index.js issues a DNS resolution and HTTPS GET to a unique subdomain under `oast.online` (an Interactsh out-of-band collection server). The callback reveals the installer's resolver IP, egress IP, and the fact that an internal build system fetched a package matching this name — the canonical dependency-confusion exfiltration signal. The README self-identifies the package as security research, and the version string contains `security-research`, but an installer cannot distinguish authorized research from real exploitation: the network beacon and information disclosure happen identically in both cases, and whoever controls the Interactsh subdomain receives the data.\n\n## Source: ossf-package-analysis (7387d5655b4341cd75024769045f64a7a2e6315e948c9b2e9789c9704f48ecc7)\nThe OpenSSF Package Analysis project identified 'uisp-connector' @ 99.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","modified":"2026-06-11T00:16:29.260496213Z","published":"2026-06-06T19:29:29Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-06-06T19:34:10.225843713Z","modified_time":"2026-06-06T19:29:29Z","versions":["99.0.0"],"source":"ossf-package-analysis","sha256":"7387d5655b4341cd75024769045f64a7a2e6315e948c9b2e9789c9704f48ecc7"},{"modified_time":"2026-06-09T20:44:15Z","versions":["0.0.1-security-research"],"source":"amazon-inspector","sha256":"9f2716a2af0ca7a9cfaa91ed2de5c46667d7630eae137db8c89a0e3911137115","import_time":"2026-06-09T20:46:00.200545244Z","id":"IN-MAL-2026-005246"},{"versions":["0.0.1-security-research"],"source":"amazon-inspector","sha256":"351b32a85d024168970d1a2e8b7c9c5e6ff6f1d31191390f248a988d9ea6b9a9","import_time":"2026-06-09T20:46:00.000835265Z","id":"IN-MAL-2026-005245","modified_time":"2026-06-09T20:44:15Z"},{"import_time":"2026-06-11T00:00:58.122267885Z","id":"IN-MAL-2026-005318","modified_time":"2026-06-10T23:35:23Z","versions":["0.0.2-security-research"],"source":"amazon-inspector","sha256":"ab14e5e62703677f925845467d6f0a844cfd4d0467f5e44cfa675540c45a5280"},{"source":"amazon-inspector","sha256":"e029f127d48e58f34bbe52151b28b8bf4b358cb857e0813c9ab8bb32a5307ccc","import_time":"2026-06-11T00:00:58.212524779Z","id":"IN-MAL-2026-005319","modified_time":"2026-06-10T23:35:24Z","versions":["0.0.2-security-research"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/uisp-connector/v/0.0.1-security-research"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/uisp-connector/v/0.0.2-security-research"}],"affected":[{"package":{"name":"uisp-connector","ecosystem":"npm","purl":"pkg:npm/uisp-connector"},"versions":["99.0.0","0.0.1-security-research","0.0.2-security-research"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"domains":["uisp-connector.d8hiivedv3ok8hrng5eghchyw4hwsioaz.oast.online","d8hiivedv3ok8hrng5eghchyw4hwsioaz.oast.online"],"evidence_files":[{"path":"index.js","sha256":"2b69d2079ba54577c5504155eb3372887fa8dced9beccd156e2959cbf76b28fc","tlsh":"a1d0c2e923a0f2740aa2a8d4d284f82f8003d00033ac6010942846b59c86779a9e09d1"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-BlNI0UC7Y74aMCCX6X+jI2DAcPH3zbgtZNIMp5/1U04zHOFW4bv+qc02Nzif6zbZN1PwLzPkhWRGGMtxrKLTYA==","sha1":"e5bc18f246ebc6a86b36275e55cffa9f41712cef"},"filename":"uisp-connector-0.0.1-security-research.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/uisp-connector/MAL-2026-5288.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}