Malicious code in @telekom-ods/react-ui-kit (npm)

@telekom-ods/react-ui-kit@2.6.9 shipped with a malicious npm install hook that executed a reconnaissance and exfiltration payload. The hook spawned a shell command that read sensitive system files including /etc/passwd, /etc/hosts, and conditionally /etc/shadow if readable, along with output from the id command.

The collected system information was exfiltrated via an HTTP POST request to an out-of-band interaction (OAST) callback server at d9t83osijf9n1gb62e4gxfioysijywqww.oast.me. The victim's whoami and hostname outputs were embedded in the callback URL path (/telekom-ods/$(whoami)/$(hostname)/), allowing the attacker to fingerprint each compromised host and receive system file contents in a single request without needing to log POST bodies.

The malicious version was published under the legitimate telekom-ods publisher account, which had published prior legitimate releases under the same scope. This suggests either a compromised maintainer account or token, or a supply-chain injection into the release pipeline rather than a simple typosquatting attack.

The package has since been removed or remediated from the npm registry.