Malicious code in base-ui-cli (npm)
The npm package 'base-ui-cli' version 1.1.47 is identified as malicious. It issues fetch() requests to a suspicious Cloudflare Workers host controlled by an individual rather than an official registry, potentially allowing attacker-controlled substitution of package content or interception of credential-bearing requests. The package name mimics a legitimate Base UI component library, suggesting it is an imposter designed to deceive users.
AI Analysis
Technical Summary
The 'base-ui-cli' npm package version 1.1.47 routes package-manager-related network traffic through a Cloudflare Workers proxy (https://base-ui-pro-registry.l-dimitrov.workers.dev) controlled by an individual, not by any official vendor or registry infrastructure. This proxy mirrors the official npm registry but enables an attacker to deliver substituted package content or capture credentials. The package name is crafted to resemble the unrelated Base UI component library, indicating a lookalike or imposter package intended to deceive developers and compromise their supply chain.
Potential Impact
Users installing or interacting with 'base-ui-cli' version 1.1.47 risk receiving maliciously altered package content or exposing credentials to an attacker-controlled proxy. This can lead to supply chain compromise, unauthorized code execution, or credential theft. No evidence of active exploitation is reported, but the presence of malicious network redirection poses a significant security risk.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing or using 'base-ui-cli' version 1.1.47. Verify package authenticity by using official registries and trusted sources only. Monitor vendor advisories for updates or removal of the malicious package from npm. Consider scanning existing dependencies for this package and removing it if found.
Malicious code in base-ui-cli (npm)
Description
The npm package 'base-ui-cli' version 1.1.47 is identified as malicious. It issues fetch() requests to a suspicious Cloudflare Workers host controlled by an individual rather than an official registry, potentially allowing attacker-controlled substitution of package content or interception of credential-bearing requests. The package name mimics a legitimate Base UI component library, suggesting it is an imposter designed to deceive users.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'base-ui-cli' npm package version 1.1.47 routes package-manager-related network traffic through a Cloudflare Workers proxy (https://base-ui-pro-registry.l-dimitrov.workers.dev) controlled by an individual, not by any official vendor or registry infrastructure. This proxy mirrors the official npm registry but enables an attacker to deliver substituted package content or capture credentials. The package name is crafted to resemble the unrelated Base UI component library, indicating a lookalike or imposter package intended to deceive developers and compromise their supply chain.
Potential Impact
Users installing or interacting with 'base-ui-cli' version 1.1.47 risk receiving maliciously altered package content or exposing credentials to an attacker-controlled proxy. This can lead to supply chain compromise, unauthorized code execution, or credential theft. No evidence of active exploitation is reported, but the presence of malicious network redirection poses a significant security risk.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing or using 'base-ui-cli' version 1.1.47. Verify package authenticity by using official registries and trusted sources only. Monitor vendor advisories for updates or removal of the malicious package from npm. Consider scanning existing dependencies for this package and removing it if found.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13522
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a75f70abf8831d53984ede0
Added to database: 08/07/2026, 15:17:30 UTC
Last enriched: 08/07/2026, 15:24:47 UTC
Last updated: 08/07/2026, 15:24:47 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.