# MAL-2026-6569: Malicious code in longzy-basic-ui (npm)


- **Type:** Malicious package
- **Package:** `longzy-basic-ui` (npm)
- **Published:** 29 Jun 2026

## What is MAL-2026-6569?

MAL-2026-6569 is a malicious package in longzy-basic-ui, published on 29 Jun 2026. 

### Official description

On `npm install`, the package's postinstall hook executes `.prepare.cjs`, which collects the installer's hostname, username, platform, Node version, non-internal network interfaces, npm registry, and a complete dump of `process.env` (every key except those prefixed `npm_lifecycle`), then HTTPS-POSTs the payload as a Lark/Feishu bot message to a hardcoded webhook on `open.larksuite.com`. The destination hostname is reversed and char-shifted by 7, and the webhook path is XOR-decoded with key `Zk9x` at runtime to hide the endpoint. Before sending, the script runs sandbox/honeypot evasion: char-code-decoded checks for AWS example credentials and honeypot tokens (`PYPI_POISON_HONEY_TOKEN`, `PP_ARTIFACT_SHA256`, `THREAT_ANALYZER_MODEL`, `ASPECT_TLOG`), sandbox env prefixes (`SANDYCLAW_`, `OPENCLAW_`, `PERMISO_`, `CHAINRADAR_`), hostname regex matching `detonat|cuckoo|virus|scan|chainradar`, and usernames such as `sandbox` and `malware`. The package's declared `homepage`/`repository.url` is an RFC1918 internal address (`http://192.168.100.4:9088/app/lzy-basic-module.git`) inconsistent with publishing to the public npm registry, and the stated purpose ("Support WoPet ui") is unrelated to the postinstall beacon. The combination of obfuscated author-controlled destination, full `process.env` exfiltration, and explicit sandbox evasion is unambiguous credential-theft malware.

## What should I do about MAL-2026-6569?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-6569 is a malicious package: longzy-basic-ui (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-6569/ (Markdown: https://insights.sbomify.com/MAL-2026-6569/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-6569

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-6569/
Summaries are generated and may contain mistakes; the official description above is the record.