Malicious code in base-ui-cli (npm)
The npm package base-ui-cli contains malicious code that makes unauthorized fetch() calls to an attacker-controlled Cloudflare Workers endpoint (base-ui-pro-registry.l-dimitrov.workers.dev) in addition to the legitimate npm registry. The package name appears designed to impersonate the unrelated Base UI component library, suggesting a typosquatting attack.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on installation count and whether credentials were exfiltrated through the attacker-controlled proxy.
- Ecosystems
- Attack vectors
- Affected entities
- base-ui-clinpm package containing malicious code in dist/index.js
The npm package base-ui-cli was found to contain malicious code in its dist/index.js file. The package makes fetch() calls to both the legitimate npm registry (https://registry.npmjs.org) and an attacker-controlled Cloudflare Workers endpoint (https://base-ui-pro-registry.l-dimitrov.workers.dev).
The attacker-controlled host is registered under l-dimitrov.workers.dev, indicating individual rather than official vendor control. By routing package-manager-adjacent traffic through this proxy, the attacker could intercept, modify, or substitute package content, or harvest credentials and authentication tokens from legitimate registry requests.
The package name 'base-ui-cli' appears designed to evoke the legitimate Base UI component library, suggesting a lookalike/imposter attack (typosquatting). This naming strategy likely increases the likelihood of accidental installation by developers searching for or depending on the real Base UI library.
The malicious package was identified by Amazon Inspector and reported through the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- base-ui-cli
- Domains
- base-ui-pro-registry.l-dimitrov.workers.dev
- l-dimitrov.workers.dev
- Hashes
- 6bd7a855915fc307b9d0c8feee91b135ea2724c300205df6fd3dcb32833ee95b
Remediation
- Immediately uninstall base-ui-cli from all systems and projects
- Audit npm install logs and dependency trees to identify all systems where base-ui-cli was installed
- Rotate any npm authentication tokens or credentials that may have been exposed through the attacker-controlled proxy
- Review network logs for any outbound connections to base-ui-pro-registry.l-dimitrov.workers.dev or l-dimitrov.workers.dev
- If credentials were used on systems running base-ui-cli, rotate those credentials across all services
- Use the legitimate Base UI library (if needed) and verify its authenticity via official sources
- Implement package name verification and allowlisting in dependency management to prevent similar typosquatting attacks
Sources
- GitHub Advisory GHSA-f9vq-gmqj-9pxv · GitHub Advisory Database
Cite this entry
"Malicious code in base-ui-cli (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-base-ui-cli-npm-1qre2p
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in akamai-sensor (npm)
A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in @finaxis/common-js (npm)
The npm package @finaxis/common-js was published with a README and keywords copied from lodash v4.18.1, but contained a heavily obfuscated Xelis (XEL) proof-of-work cryptominer instead of lodash functionality. Consumers installing this package would unknowingly run a covert CPU/GPU miner on their systems.
npmCompromised packageTyposquatting - containedcritical
Malicious code in axios-fast (npm)
axios-fast@1.0.1 on npm contains malicious code that exfiltrates environment variables (including AWS credentials, NPM tokens, and GitHub tokens) to an attacker-controlled webhook during package installation. The package typosquats the legitimate axios HTTP client library.
npmCompromised packageTyposquatting