OpenSSF/OSV advisory MAL-2026-3681 confirms this npm version as malicious. The package declares a postinstall lifecycle hook (`"postinstall": "node postinstall.js"` in package.json) that runs automatically during `npm install`. postinstall.js (lines 1-22) collects `os.hostname()`, `os.userInfo().username`, `process.cwd()`, and the entire `process.env` object, JSON-serializes them, and POSTs the payload over HTTPS to `attacker.appsec.cc:9999/exfiltrate`...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @catamania/ui-components (npm)
Details
The package declares a postinstall lifecycle hook (`"postinstall": "node postinstall.js"` in package.json) that runs automatically during `npm install`. postinstall.js (lines 1-22) collects `os.hostname()`, `os.userInfo().username`, `process.cwd()`, and the entire `process.env` object, JSON-serializes them, and POSTs the payload over HTTPS to `attacker.appsec.cc:9999/exfiltrate`. On developer workstations and CI runners, `process.env` routinely contains high-value secrets (NPM_TOKEN, GITHUB_TOKEN, AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, CI provider tokens, database URLs). Errors are swallowed silently, a classic exfiltration-stealth technique. The package self-describes as internal UI components, which provides no legitimate justification for reading or transmitting environment variables. This is an unambiguous credential-theft supply-chain attack against the installer.
Decision reason
OpenSSF Malicious Packages via OSV confirms @catamania/ui-components@1.0.1 as malicious (MAL-2026-3681): Malicious code in @catamania/ui-components (npm)