{"answers":{"affected":"1 open source package ship an affected version, including @telekom-ods/react-ui-kit.","exploited":"There is no known exploitation of MAL-2026-13770 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-13770 is a malicious package in @telekom-ods/react-ui-kit, published on 11 Aug 2026."},"fix_prompt":"MAL-2026-13770 is a malicious package: @telekom-ods/react-ui-kit (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-13770/ (Markdown: https://insights.sbomify.com/MAL-2026-13770/index.md)","id":"MAL-2026-13770","markdown":"https://insights.sbomify.com/MAL-2026-13770/index.md","name":"MAL-2026-13770","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"@telekom-ods/react-ui-kit@2.6.9 ships an install hook that spawns a shell running a reconnaissance/exfiltration one-liner. The captured command reads `/etc/passwd` and `/etc/hosts`, runs `id`, and conditionally reads `/etc/shadow` if the process has read access, then sends the collected output as the `User-Agent` header of an HTTP POST to an out-of-band interaction (OAST) callback host at `d9t83osijf9n1gb62e4gxfioysijywqww.oast.me`, with the victim's `whoami` and `hostname` output embedded directly in the callback URL path (`/telekom-ods/$(whoami)/$(hostname)/`) — allowing the operator to both fingerprint each compromised host and receive system file contents in a single request, without needing to run a listener that logs POST bodies.\n\nSandbox capture of the spawned command was truncated after the `/etc/shadow` conditional; the exact fields exfiltrated beyond `/etc/passwd`, `/etc/hosts`, and `id` output were not fully recovered, but the confirmed portion already demonstrates local system file exfiltration via OAST callback, independent of whatever else the full script sends.\n\nThe npm registry metadata for this version showed the same publisher (`telekom-ods`) as prior legitimate releases under this scope, rather than a fresh or newly-registered account, suggesting either a compromised maintainer account/token or a supply-chain injection into the release pipeline rather than a simple namesquat. The package has since been fully removed from npm (the scope currently resolves with zero published versions).\n\nAny environment where this version was installed should be treated as having had `/etc/passwd`, `id` output, and possibly `/etc/shadow` (on hosts where the installing user had read access) exposed to the attacker via the OAST callback; treat local user credentials and any password hashes present on the host as compromised and rotate accordingly.\n\nThe package.json preinstall hook runs `node index.js`, which reads `os.hostname()` and `os.userInfo().username` and issues an HTTPS GET to a hardcoded subdomain of `oast.online`, embedding those host identifiers in the URL path (e.g. `https://d9t67n4ijf9j5pmd6ug0sij3zd49twn1k.oast.online/telekomDT/\u003chostname\u003e-\u003cusername\u003e`). The scope `@telekom-ods` mimics an internal Deutsche Telekom namespace, and the automatic install-time callout to an out-of-band interaction service is the classic dependency-confusion probe shape: any environment that installs this name reveals its hostname and username to whoever controls the OAST collaborator token. Even if self-described as a research PoC, the published artifact performs unauthenticated exfiltration of installer identifiers on `npm install`.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in @telekom-ods/react-ui-kit (npm)","id":"MAL-2026-13770","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"@telekom-ods/react-ui-kit","purl":"pkg:npm/%40telekom-ods/react-ui-kit","source":"MAL-2026-13770"}],"products":null,"published":"2026-08-11","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-13770/"}