MalwarePublished 13 Oct 2026Updated 3 Nov 2026

@mntv-analysis/ui (npm) · Malicious Code

Affects @mntv-analysis/uiSource GCVE Database

Malicious package : remove @mntv-analysis/ui and rotate any secrets on hosts that installed it.

Data as of 3 Nov 2026, 23:58 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-17869

What to do

Remove @mntv-analysis/ui from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@mntv-analysis/ui	Affected =99.1.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package '@mntv-analysis/ui' version 99.1.1 is a malicious package published by the user 'conx3993' as part of a dependency confusion attack. It masquerades as an internal package and uses a high version number to be preferentially resolved by misconfigured package resolvers. During installation, a preinstall script runs that sends an HTTPS request to an attacker-controlled server, leaking the victim's public IP address and a unique authorization token identifying the installed package. The package contains no legitimate UI functionality and acts as a beacon to tag victims. Systems with this package installed should be considered fully compromised.

Impact

The installation of this package results in the victim's public IP address and a unique authorization token being sent to an attacker-controlled server, enabling the attacker to identify and track victims who installed the package. The GHSA malware advisory states that any computer with this package installed should be considered fully compromised, implying potential unauthorized access or control. Consequently, all secrets and keys stored on the affected system are at risk and should be rotated immediately. Removal of the package alone does not guarantee eradication of all malicious software that may have been installed.

Defensive guidance

Remove the malicious package '@mntv-analysis/ui' version 99.1.1 immediately from all affected systems. Treat any system with this package installed as fully compromised. Rotate all secrets, credentials, and keys stored on the affected systems from a separate, trusted machine. Review and correct package resolver configurations to prevent dependency confusion attacks by ensuring internal packages cannot be overridden by external packages with similar names. Monitor for any suspicious activity that may indicate further compromise.

Summary

This threat involves a malicious npm package '@mntv-analysis/ui' published by 'conx3993' in a dependency confusion campaign. The package uses version 99.1.1 to override legitimate internal packages in environments with misconfigured resolvers. Its 'preinstall' script executes 'index.js' which sends an HTTPS GET request to 'https://realwbx.com/ip.php?ip=8.8.8.8' with a hardcoded 'Authorization' header unique to the package. This request reveals the victim's public egress IP and signals to the attacker which internal package was installed. The package itself provides no functional UI code and is designed solely as a victim-tagging beacon. According to the GHSA malware source, any system with this package installed should be treated as fully compromised, and all secrets and keys on that system should be rotated from a separate, trusted machine.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 3 Nov 2026, 23:58 UTC

Technical details

References

Community reviews