Malicious code in @convera/ui-shared (npm)

The npm package @convera/ui-shared version 0.0.2 was identified as malicious by both Amazon Inspector and the OpenSSF Package Analysis project. Upon installation, the package's preinstall.js script executed code that collected the system hostname via os.hostname() and the current user via os.userInfo().username, then transmitted this information as query parameters to am0f14nl6o1nqwrngbrq33amfdl496xv.oastify.com, a Burp Collaborator subdomain.\n\nThe package was published under the @convera/* scope, matching a private internal namespace used by the Convera organization. This created a dependency-confusion attack surface: developers or systems that misconfigured their registry settings or accidentally resolved the public npm version instead of an internal private registry would silently install the malicious package. The package contained no functional code beyond the exfiltration mechanism, shipping only an empty index.js file.\n\nThe package description identified itself as a 'bug-bounty research placeholder — Convera', though regardless of stated intent, the unauthorized collection of host identifiers from every installer constitutes a supply chain attack. The malicious activity was detected and the package has been removed from npm.\n\nCredits: Amazon Inspector, OpenSSF Package Analysis project, and OpenSSF malicious-packages repository.