MAL-2026-16319
Malicious code in @dbbhk/ui-components (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (478839dda68d2c5eefa1a55557602d4b12396c988211b28d785af531d0b19d07) @dbbhk/ui-components@99.0.0 declares both preinstall and postinstall hooks in package.json that execute `node callback.js`, so the payload runs automatically on `npm install`. callback.js queries the AWS instance metadata service at 169.254.169.254 for IAM role credentials, reads ECS task-role credentials via AWS_CONTAINER_CREDENTIALS_RELATIVE_URI, iterates process.env harvesting variables matching AWS/SECRET/KEY/TOKEN/PASSWORD/CREDENTIAL/AUTH/API/NPM/GITHUB/GITLAB patterns, and reads credential files including ~/.aws/credentials, /root/.aws/credentials, ~/.npmrc,.env,.npmrc, and the Kubernetes service-account token at /var/run/secrets/kubernetes.io/serviceaccount/token. It also collects host reconnaissance (hostname, whoami, id, platform, cwd, home directory, and CI-provider fingerprint for GitHub Actions/GitLab/Jenkins). Collected data is POSTed via https.request to api.telegram.org/bot<token>/sendMessage against a hardcoded Telegram bot and chat id 1064260758. The package name and scope impersonate an HSBC internal component (dependency-confusion shape with an implausibly high 99.0.0 version), and a header comment self-labels the file as an HSBC bug-bounty PoC; the code performs indiscriminate credential harvesting on any installer regardless of that framing.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for @dbbhk/ui-components (npm). Pin to a known-safe version or switch to an alternative.