{"answers":{"affected":"1 open source package ship an affected version, including cilm-ui-commons.","exploited":"There is no known exploitation of MAL-2026-13943 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-13943 is a malicious package in cilm-ui-commons, published on 13 Aug 2026."},"fix_prompt":"MAL-2026-13943 is a malicious package: cilm-ui-commons (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-13943/ (Markdown: https://insights.sbomify.com/MAL-2026-13943/index.md)","id":"MAL-2026-13943","markdown":"https://insights.sbomify.com/MAL-2026-13943/index.md","name":"MAL-2026-13943","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On npm install, the preinstall hook executes index.js which collects host identity data (os.hostname(), os.userInfo().username, os.homedir(), current working directory, DNS server list) together with the full package.json contents and POSTs them to the hardcoded external endpoint https://eogo57c0daum9d3.m.pipedream.net. The behavior fires unconditionally at install time on every installer machine. A code comment references burpcollaborator/Interactsh-style beaconing, consistent with dependency-confusion reconnaissance: the beacon fires when a private internal package name is inadvertently resolved from the public npm registry, revealing the victim's internal infrastructure to whoever controls the pipedream endpoint. The exfiltrated fields identify the installer's host, user account, filesystem layout, network DNS configuration, and internal package/dependency graph.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in cilm-ui-commons (npm)","id":"MAL-2026-13943","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"cilm-ui-commons","purl":"pkg:npm/cilm-ui-commons","source":"MAL-2026-13943"}],"products":null,"published":"2026-08-13","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-13943/"}