Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in dbk-ui-forms (npm)

The npm package dbk-ui-forms version 99.0.1 contained malicious code that executed during installation, collecting sensitive host and environment information and exfiltrating it to an attacker-controlled domain. The package appears to be a dependency-confusion attack targeting internal build systems.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any developer or build system that installs dbk-ui-forms version 99.0.1 from npm
Ecosystems
npm
Attack vectors
Compromised packageDependency confusion
Affected entities
  • dbk-ui-forms · 99.0.1

The npm package dbk-ui-forms version 99.0.1 contained malicious code that executed via a preinstall hook during package installation. The hook ran index.js, which collected sensitive information from the host system including hostname, username, home directory, network interfaces, and user/group IDs.

The malicious script also captured environment variable names matching a broad credential pattern (including key, token, secret, pass, auth, cred, npm, ci, build, jenkins, github, gitlab, aws, and azure). This data was exfiltrated via HTTPS POST, HTTP POST, and DNS-encoded lookups to the hardcoded Interactsh subdomain ycwyyoimdcluajepubah2mvmkibt4h5wm.oast.fun.

The package name and version (99.0.1) are consistent with a dependency-confusion attack, where an attacker publishes a malicious package with a name matching an internal/unclaimed package to compromise build systems that resolve dependencies from the public registry. The incident was identified and credited to the OpenSSF malicious-packages project.

Indicators of compromise

Packages
  • dbk-ui-forms
Domains
  • ycwyyoimdcluajepubah2mvmkibt4h5wm.oast.fun

Remediation

  • Immediately remove dbk-ui-forms version 99.0.1 from all systems and build environments
  • Audit npm install logs and CI/CD logs for evidence of installation of this package
  • Rotate all credentials and secrets that may have been exposed (API keys, tokens, passwords, SSH keys, AWS credentials, GitHub tokens, etc.)
  • Review network logs for connections to ycwyyoimdcluajepubah2mvmkibt4h5wm.oast.fun
  • Implement npm package verification and scanning in CI/CD pipelines to detect malicious packages
  • Use npm audit and security scanning tools to identify other potentially compromised dependencies
  • Consider using private npm registries or package allowlists to prevent dependency-confusion attacks

Sources

  1. GitHub Advisory GHSA-6xhg-r9f8-79h9 · GitHub Advisory Database

Cite this entry

"Malicious code in dbk-ui-forms (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-dbk-ui-forms-npm-1anyll

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

    Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.

    npmDependency confusionCompromised package
  2. containedcritical

    Malicious code in stillm4ddpocs-demo-sprocket (npm)

    The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.

    npmCompromised packageDependency confusion
  3. resolvedcritical

    Malicious code in lumen-pages-community (npm)

    lumen-pages-community@9.9.9 on npm contains malicious code that executes a postinstall hook to exfiltrate installer metadata (hostname, username, working directory, platform, Node version, CI environment, npm user-agent) to a hardcoded webhook.site URL. The high version number and lack of functionality suggest a dependency-confusion attack.

    npmCompromised packageDependency confusion
  4. resolvedcritical

    Malicious code in @gfe/lx-watcher (npm)

    The npm package @gfe/lx-watcher contained malicious code that exfiltrated host metadata (hostname, OS username, working directory, timestamp) via npm lifecycle hooks to a hardcoded webhook.site endpoint. The package exploited dependency confusion by using a scoped name (@gfe/*) with a no-op stub, allowing silent resolution against the public registry while leaking host identifiers.

    npmDependency confusionCompromised package