mal-2026-16409
Vulnerability from ossf_malicious_packages
Published
2026-09-22 19:50
Modified
2026-09-23 02:27
Summary
Malicious code in ubiquiti-agents-link-mcp (npm)
Details
-= Per source details. Do not edit below this line.=-
Source: amazon-inspector (8827e987697ea6ef619055c53ae1654800a838c18419ffc8a09e872c6f16adc4)
The package's bin entry (index.js) runs execSync('id') and collects os.userInfo().username and os.hostname(), then HTTPS-POSTs the JSON payload to the hardcoded Burp Collaborator subdomain uhffaanwxy0io5bfc0icu5lpug07o9cy.oastify.com at a randomized path. The package occupies an npm name referenced by a vendor UI that instructs operators to invoke it via npx, so running the documented command causes host identity data to leave the operator's machine to a third-party OAST endpoint with no opt-in. The tarball metadata self-describes the release as a placeholder registered to demonstrate the dependency-confusion vector, but the shipped code performs a real installer-side data leak on execution, and the namespace remains available for future publishes by the same account with operator-level code execution on any host following the vendor's instruction.
Source: ossf-package-analysis (bb2bd11478a4b45a05adf8ac3c9b4ddeb169297b9c280916a25eccd4dd827922)
The OpenSSF Package Analysis project identified 'ubiquiti-agents-link-mcp' @ 0.0.1 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
CWE
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
{
"affected": [
{
"database_specific": {
"cwes": [
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
}
],
"indicators": {
"evidence_files": [
{
"path": "index.js",
"sha256": "b0dc582943ece637c6fef90b3dcb1c55aa19a9136ced62fd8d3ad9d25ea70b81",
"tlsh": "70f00ebca3f6007839f014c074507d5af05bc025b296a3c4f58d0f2081abcf451b9ac2"
},
{
"path": "package.json",
"sha256": "7d73be709354b2a395d566edffcbbe54ba16ab294026bc432b9de08bb65ee0cb",
"tlsh": "11f04163147514630ac983101a71bfaf5b1680293243e351b33b736cb0260bc12373e7"
}
],
"package_integrity": [
{
"filename": "ubiquiti-agents-link-mcp-0.0.1.tgz",
"hashes": {
"sha1": "0d410c17ae675f262c78ae5b8088dd8f897d1f6a",
"sha512_sri": "sha512-gsGzv+fx89N+8v+KsbR00XmubjmDJuxHR4DkQQ/zyfXIjLpTKFwOFsSX+jbV3cledb1oqWn/TRMsQhZ5K8REMQ=="
}
}
]
}
},
"package": {
"ecosystem": "npm",
"name": "ubiquiti-agents-link-mcp"
},
"versions": [
"0.0.1",
"0.0.2",
"0.2.0",
"0.2.1"
]
}
],
"credits": [
{
"contact": [
"inspector-research@amazon.com"
],
"name": "Amazon Inspector",
"type": "FINDER"
},
{
"contact": [
"https://github.com/ossf/package-analysis",
"https://openssf.slack.com/channels/package_analysis"
],
"name": "OpenSSF: Package Analysis",
"type": "FINDER"
}
],
"database_specific": {
"malicious-packages-origins": [
{
"import_time": "2026-09-22T20:17:17.852399391Z",
"modified_time": "2026-09-22T19:50:54Z",
"sha256": "bb2bd11478a4b45a05adf8ac3c9b4ddeb169297b9c280916a25eccd4dd827922",
"source": "ossf-package-analysis",
"versions": [
"0.0.1"
]
},
{
"import_time": "2026-09-22T20:40:21.481724192Z",
"modified_time": "2026-09-22T20:19:39Z",
"sha256": "b158c1e8beba133d0c5f07c85a0bfc80fe0e57d2bcbdf0e822464a43a70f1bbf",
"source": "ossf-package-analysis",
"versions": [
"0.0.2"
]
},
{
"id": "IN-MAL-2026-020314",
"import_time": "2026-09-22T22:16:11.644163054Z",
"modified_time": "2026-09-22T21:52:16Z",
"sha256": "26ca7cb3560e8fde1d27dacc2bbed1f2977ac793985ce681ffcb84badefc2d17",
"source": "amazon-inspector",
"versions": [
"0.0.1"
]
},
{
"id": "IN-MAL-2026-020308",
"import_time": "2026-09-22T22:16:11.092215219Z",
"modified_time": "2026-09-22T21:50:51Z",
"sha256": "7b6d6b384dff92a5d360b0655b27134e713b606471114fa03d1227901960a7ed",
"source": "amazon-inspector",
"versions": [
"0.2.0"
]
},
{
"id": "IN-MAL-2026-020313",
"import_time": "2026-09-22T22:16:11.5772971Z",
"modified_time": "2026-09-22T21:52:08Z",
"sha256": "8827e987697ea6ef619055c53ae1654800a838c18419ffc8a09e872c6f16adc4",
"source": "amazon-inspector",
"versions": [
"0.0.2"
]
},
{
"id": "IN-MAL-2026-020334",
"import_time": "2026-09-23T02:26:00.454098582Z",
"modified_time": "2026-09-23T01:58:37Z",
"sha256": "5fc7dc8a95dc5fd675809c56232bd62921143cda109be898194b2a03966894fb",
"source": "amazon-inspector",
"versions": [
"0.2.1"
]
}
]
},
"details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8827e987697ea6ef619055c53ae1654800a838c18419ffc8a09e872c6f16adc4)\nThe package\u0027s bin entry (index.js) runs `execSync(\u0027id\u0027)` and collects `os.userInfo().username` and `os.hostname()`, then HTTPS-POSTs the JSON payload to the hardcoded Burp Collaborator subdomain `uhffaanwxy0io5bfc0icu5lpug07o9cy.oastify.com` at a randomized path. The package occupies an npm name referenced by a vendor UI that instructs operators to invoke it via `npx`, so running the documented command causes host identity data to leave the operator\u0027s machine to a third-party OAST endpoint with no opt-in. The tarball metadata self-describes the release as a placeholder registered to demonstrate the dependency-confusion vector, but the shipped code performs a real installer-side data leak on execution, and the namespace remains available for future publishes by the same account with operator-level code execution on any host following the vendor\u0027s instruction.\n\n## Source: ossf-package-analysis (bb2bd11478a4b45a05adf8ac3c9b4ddeb169297b9c280916a25eccd4dd827922)\nThe OpenSSF Package Analysis project identified \u0027ubiquiti-agents-link-mcp\u0027 @ 0.0.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n",
"id": "MAL-2026-16409",
"modified": "2026-09-23T02:27:56.023447503Z",
"published": "2026-09-22T19:50:54Z",
"references": [
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/ubiquiti-agents-link-mcp/v/0.0.1"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/ubiquiti-agents-link-mcp/v/0.2.0"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/ubiquiti-agents-link-mcp/v/0.0.2"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/ubiquiti-agents-link-mcp/v/0.2.1"
}
],
"schema_version": "1.7.4",
"summary": "Malicious code in ubiquiti-agents-link-mcp (npm)"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…