MAL-2026-13770 Malicious code in @telekom-ods/react-ui-kit (npm)

@telekom-ods/[email protected] ships an install hook that spawns a shell running a reconnaissance/exfiltration one-liner. The captured command reads /etc/passwd and /etc/hosts, runs id, and conditionally reads /etc/shadow if the process has read access, then sends the collected output as the User-Agent header of an HTTP POST to an out-of-band interaction (OAST) callback host at d9t83osijf9n1gb62e4gxfioysijywqww.oast.me, with the victim's whoami and hostname output embedded directly in the callback URL path (/telekom-ods/$(whoami)/$(hostname)/) — allowing the operator to both fingerprint each compromised host and receive system file contents in a single request, without needing to run a listener that logs POST bodies.

Sandbox capture of the spawned command was truncated after the /etc/shadow conditional; the exact fields exfiltrated beyond /etc/passwd, /etc/hosts, and id output were not fully recovered, but the confirmed portion already demonstrates local system file exfiltration via OAST callback, independent of whatever else the full script sends.

The npm registry metadata for this version showed the same publisher (telekom-ods) as prior legitimate releases under this scope, rather than a fresh or newly-registered account, suggesting either a compromised maintainer account/token or a supply-chain injection into the release pipeline rather than a simple namesquat. The package has since been fully removed from npm (the scope currently resolves with zero published versions).

Any environment where this version was installed should be treated as having had /etc/passwd, id output, and possibly /etc/shadow (on hosts where the installing user had read access) exposed to the attacker via the OAST callback; treat local user credentials and any password hashes present on the host as compromised and rotate accordingly.

The package.json preinstall hook runs node index.js, which reads os.hostname() and os.userInfo().username and issues an HTTPS GET to a hardcoded subdomain of oast.online, embedding those host identifiers in the URL path (e.g. https://d9t67n4ijf9j5pmd6ug0sij3zd49twn1k.oast.online/telekomDT/<hostname>-<username>). The scope @telekom-ods mimics an internal Deutsche Telekom namespace, and the automatic install-time callout to an out-of-band interaction service is the classic dependency-confusion probe shape: any environment that installs this name reveals its hostname and username to whoever controls the OAST collaborator token. Even if self-described as a research PoC, the published artifact performs unauthenticated exfiltration of installer identifiers on npm install.