MalwarePublished 5 Aug 2026Updated 24 Sep 2026

electrode-ota-ui-app (npm) · Malicious Code

Affects electrode-ota-ui-appSource GCVE Database

Malicious package : remove electrode-ota-ui-app and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:15 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12368

What to do

Remove electrode-ota-ui-app from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmelectrode-ota-ui-app	Affected =99.0.1 =99.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (6b9fb0d73b7d26454a227e93754f11ff2405424b1279490863055e8d8c8c6498) Package targets the electrode-io internal name `electrode-ota-ui-app` with an inflated 99.0.1 version to win dependency resolution against a private registry. package.json declares both `main: index.js` and `scripts.postinstall: node index.js`, so on `npm install` and on any `require()` the package unconditionally runs `collectAndSend()` in index.js. That function gathers host identifiers via `os.hostname()`, `os.userInfo()`, `os.platform()`, and `os.release()`, resolves the installer's public IP via ipify and geo/ISP data via ipapi.co, and POSTs a JSON payload to the hardcoded Burp Collaborator subdomain `https://itfv50wbocctx0j32fyfq8z7uy0ptdn1c.oastify.com/callback`, controlled by the package author. README self-labels as a dependency-confusion PoC, but the callback is live and any installer whose resolver picks this public package over the intended internal one is compromised.

Impact

Any system that installs this package version 99.0.1 may have sensitive host information and public IP geolocation data exfiltrated to an attacker-controlled server. This can lead to information disclosure and potential further targeting. The malicious code runs automatically on npm install and on any require() of the package, increasing the risk of compromise in development or deployment environments relying on this package name.

Defensive guidance

Avoid installing electrode-ota-ui-app version 99.0.1 from public npm registries. Verify package sources and lock dependencies to trusted internal registries. Remove any installations of this package version and audit environments for potential data leakage. Monitor dependency resolution configurations to prevent dependency confusion attacks.

Summary

The electrode-ota-ui-app npm package at version 99.0.1 is a malicious package designed to exploit dependency confusion. It declares a post-install script and a main entry point that both execute a function collecting host identifiers (hostname, user info, platform, OS release) and public IP geolocation data from external services. This data is then exfiltrated via an HTTP POST request to a hardcoded Burp Collaborator subdomain controlled by the attacker. The package's inflated version number (99.0.1) is intended to win dependency resolution over a private internal registry, causing unintended installation and data leakage.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 17:15 UTC

Technical details

References

Community reviews