Malicious code in uibabai (npm)
The npm package uibabai contained malicious code that executed on require/import, using Ethereum blockchain as a dead-drop resolver to fetch and execute encrypted C2 payloads. The malicious code was obfuscated using unicode escapes and communicated with hardcoded Ethereum address 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a to derive C2 endpoints.
- Disclosed
- Last updated
- Blast radius
- Any user or system that installed or required the malicious uibabai package
- Ecosystems
- Attack vectors
- Affected entities
- uibabainpm package with malicious code in index.js
The npm package uibabai was compromised with malicious code appended to a legitimate Tailwind plugin export in index.js. The malicious payload executed automatically on any require() or import of the package.
The attack used an innovative blockchain-based dead-drop resolver: the code queried the public Ethereum RPC endpoint eth.drpc.org for transactions from the hardcoded address 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a. It derived an IPv4 C2 endpoint from the first 4 bytes of the transaction's to field, allowing the attacker to rotate C2 infrastructure by publishing new Ethereum transactions without modifying the package.
The malicious code fetched XOR-encrypted payloads over plain HTTP from paths /0x/cls and /0x/ls, decrypted them, and executed the resulting bytes via eval() and spawned node -e child processes. Identifiers including require, http, https, child_process, and RPC method names were hidden behind \uXXXX unicode escapes to evade detection.
The incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- uibabai
- Domains
- eth.drpc.org
Remediation
- Immediately uninstall the uibabai package from all systems
- Audit all systems where uibabai was installed for signs of compromise, including network connections to derived C2 endpoints
- Review Ethereum transactions from address 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a to identify all C2 endpoints that may have been active
- Rotate all credentials and secrets on affected systems
- Monitor for outbound HTTP connections to suspicious IPv4 addresses derived from Ethereum transaction data
- Use npm audit to identify any other compromised dependencies
Sources
- GitHub Advisory GHSA-xm2g-qfpc-cc6h · GitHub Advisory Database
Cite this entry
"Malicious code in uibabai (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-uibabai-npm-3m4qmz
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in chlklib
Malware was discovered in the npm package chlklib, resulting in full system compromise of any computer with the package installed or running. All affected systems should be considered fully compromised and all secrets and keys rotated immediately from a different computer.
npmCompromised package - resolvedcritical
Malware in alphazone
The npm package alphazone contained malware that provided full system compromise to attackers. Any computer with the package installed or running should be considered fully compromised.
npmCompromised package - containedcritical
Malware in chai-as-deployer
Malware was discovered in the npm package chai-as-deployer, resulting in full system compromise for any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package - containedcritical
Malware in checkout-common-tokens
Malware was discovered in the npm package checkout-common-tokens. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package