🛡️ MAL-2026-12054 — uibabai

Malicious code in uibabai (npm)

Source: amazon-inspector

index.js has malicious code appended after a legitimate Tailwind plugin export. On any require()/import of the package, the appended block queries the public Ethereum RPC eth.drpc.org for a transaction from the hardcoded address 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a, derives an IPv4 C2 endpoint from the first 4 bytes of the transaction's to field, fetches XOR-encrypted payloads over plain HTTP from paths /0x/cls and /0x/ls, and executes the decrypted bytes via eval and a spawned node -e child process. Identifiers such as require, http, https, child_process, POST, application/json, base64, and the eth_blockNumber/eth_getBlockByNumber RPC method names are hidden behind \uXXXX unicode escapes, and server responses are XOR-decoded before execution. The blockchain lookup functions as a dead-drop resolver so the C2 IP can be rotated by publishing a new Ethereum transaction without modifying the package.