Malicious code in uibabai (npm)
The npm package uibabai contained malicious code that executed on require/import, using Ethereum blockchain as a dead-drop resolver to fetch and execute encrypted C2 payloads. The malicious code was obfuscated using unicode escapes and communicated with hardcoded Ethereum address 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a to derive C2 endpoints.
- Disclosed
- Last updated
- Blast radius
- Any user or system that installed or required the malicious uibabai package
- Ecosystems
- Attack vectors
- Affected entities
- uibabainpm package with malicious code in index.js
The npm package uibabai was compromised with malicious code appended to a legitimate Tailwind plugin export in index.js. The malicious payload executed automatically on any require() or import of the package.
The attack used an innovative blockchain-based dead-drop resolver: the code queried the public Ethereum RPC endpoint eth.drpc.org for transactions from the hardcoded address 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a. It derived an IPv4 C2 endpoint from the first 4 bytes of the transaction's to field, allowing the attacker to rotate C2 infrastructure by publishing new Ethereum transactions without modifying the package.
The malicious code fetched XOR-encrypted payloads over plain HTTP from paths /0x/cls and /0x/ls, decrypted them, and executed the resulting bytes via eval() and spawned node -e child processes. Identifiers including require, http, https, child_process, and RPC method names were hidden behind \uXXXX unicode escapes to evade detection.
The incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- uibabai
- Domains
- eth.drpc.org
Remediation
- Immediately uninstall the uibabai package from all systems
- Audit all systems where uibabai was installed for signs of compromise, including network connections to derived C2 endpoints
- Review Ethereum transactions from address 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a to identify all C2 endpoints that may have been active
- Rotate all credentials and secrets on affected systems
- Monitor for outbound HTTP connections to suspicious IPv4 addresses derived from Ethereum transaction data
- Use npm audit to identify any other compromised dependencies
Sources
- GitHub Advisory GHSA-xm2g-qfpc-cc6h · GitHub Advisory Database
Cite this entry
"Malicious code in uibabai (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-uibabai-npm-3m4qmz
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in santana-baileys (npm)
Malicious code discovered in santana-baileys npm package that covertly relays WhatsApp messaging data to an attacker-controlled endpoint (https://fiora.nixel.my.id/) via obfuscated character-code reconstruction in the message-send code path.
npmCompromised package - resolvedcritical
Malicious code in elephant-tusk-runner (npm)
The npm package elephant-tusk-runner contained malicious code that exposed a remote shell and remote code execution surface via an unauthenticated Express + WebSocket server binding to 0.0.0.0:4201 with fully open CORS. Any peer able to reach the port could execute arbitrary commands on the host.
npmCompromised package - resolvedcritical
Malicious code in @cats-cdf/browser-metrics-meter (npm)
The npm package @cats-cdf/browser-metrics-meter contained malicious code in its preinstall lifecycle script that exfiltrated system reconnaissance data (username, hostname, public IP) to an OAST collector domain. The package executed this behavior unconditionally on installation without consent or documented purpose.
npmCompromised package - resolvedcritical
Malicious code in @ks-video/kwai-player-web (npm)
The npm package @ks-video/kwai-player-web contained malicious code in its postinstall hook that exfiltrated system reconnaissance data (hostname, username, working directory, network interfaces, environment variable names) over plain HTTP to an unrelated third-party domain. The package has no legitimate relationship to the declared publisher Kwai/@ks-video.
npmCompromised package