Threats Tagged 'mal-2026-10227'

The box-react-uix npm package is a malicious package published as part of a dependency confusion campaign. It uses a preinstall script to execute code during npm install that collects and sends the installer's public IP address and host telemetry, including personally identifiable information, to an attacker-controlled Sentry endpoint. The package name mimics an internal namespace to trick misconfigured resolvers into installing it instead of legitimate private dependencies. The payload is consistent across all packages published by the attacker, differing only in package name and Sentry project ID. This behavior is reconnaissance-focused, allowing attribution of installs to specific victim organizations. The package version 18.6.91 is affected. There is no official patch or fix available. Installing or running this package may fully compromise the host, and all secrets on the host should be rotated from a different machine.