MalwarePublished 29 Jun 2026Updated 13 Aug 2026

@uisp/utils (npm) · Malicious Code

Affects @uisp/utilsSource GCVE Database

Malicious package : remove @uisp/utils and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 15:55 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6565

What to do

Remove @uisp/utils from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@uisp/utils	Affected =99.0.2 =99.0.1 =99.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The @uisp/utils npm package versions 99.0.0, 99.0.1, and 99.0.2 contain malicious code that executes automatically during installation. The package's preinstall script runs a command to identify the host user and exfiltrates this information encoded via DNS and HTTPS requests to an attacker-controlled server. This results in remote code execution at install time and leakage of host identity information.

Impact

Installation of affected versions of the @uisp/utils package results in remote code execution on the build host at install time and exfiltration of sensitive host identity information to an external attacker-controlled server. This compromises the security and privacy of the build environment and may facilitate further attacks.

Defensive guidance

Users should avoid installing the affected versions (=99.0.0, =99.0.1, =99.0.2) of the @uisp/utils package from the public npm registry. Verify registry configurations to prevent fallback to the public registry for private packages. Monitor for updates from the package maintainers or npm advisories for remediation guidance.

Summary

The @uisp/utils package published to the public npm registry under the @uisp scope at versions 99.0.0, 99.0.1, and 99.0.2 includes a preinstall script that executes 'node beacon.js'. This script runs 'whoami' via child_process.execSync and sends the base64-encoded output to a hardcoded Burp Collaborator domain through DNS lookups and HTTPS GET requests. Installing this package from the public registry or any misconfigured registry that falls back to it causes automatic execution of attacker-controlled code on the build host and leaks host identity information to an external collector. The README's claim of authorized research does not mitigate the risk or consent for this behavior.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Jun 2026, 22:41 UTC

Technical details

References

Community reviews