MAL-2026-13770

@telekom-ods/react-ui-kit@2.6.9 ships an install hook that spawns a shell running a reconnaissance/exfiltration one-liner. The captured command reads `/etc/passwd` and `/etc/hosts`, runs `id`, and conditionally reads `/etc/shadow` if the process has read access, then sends the collected output as the `User-Agent` header of an HTTP POST to an out-of-band interaction (OAST) callback host at `d9t83osijf9n1gb62e4gxfioysijywqww.oast.me`, with the victim's `whoami` and `hostname` output embedded directly in the callback URL path (`/telekom-ods/$(whoami)/$(hostname)/`) — allowing the operator to both fingerprint each compromised host and receive system file contents in a single request, without needing to run a listener that logs POST bodies.

Sandbox capture of the spawned command was truncated after the `/etc/shadow` conditional; the exact fields exfiltrated beyond `/etc/passwd`, `/etc/hosts`, and `id` output were not fully recovered, but the confirmed portion already demonstrates local system file exfiltration via OAST callback, independent of whatever else the full script sends.

The npm registry metadata for this version showed the same publisher (`telekom-ods`) as prior legitimate releases under this scope, rather than a fresh or newly-registered account, suggesting either a compromised maintainer account/token or a supply-chain injection into the release pipeline rather than a simple namesquat. The package has since been fully removed from npm (the scope currently resolves with zero published versions).

Any environment where this version was installed should be treated as having had `/etc/passwd`, `id` output, and possibly `/etc/shadow` (on hosts where the installing user had read access) exposed to the attacker via the OAST callback; treat local user credentials and any password hashes present on the host as compromised and rotate accordingly.