MAL-2026-10605

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b5e92ae03eb6adb090fb832665431984cccef31039bb920e3850535f4defe610)

@radivi-ui/react-dialog is a typosquat of @radix-ui/react-dialog whose main entry (index.js) is a self-executing IIFE that runs whoami and hostname via child_process.execSync when the package is loaded via require/import. The command outputs are hex-encoded and exfiltrated to the hardcoded Burp Collaborator subdomain vih2vewj1xxwlsd8dkgjqugtyk4bs1gq.oastify.com via both DNS resolution (dns.resolve of a crafted subdomain) and HTTP GET (http.get). The behavior fires unconditionally on module load with no user opt-in, no CLI gate, and no relation to any dialog/UI functionality the package name implies.

Affected Packages

@radivi-ui/react-dialog

npm

Affected versions:

1.1.31.1.4

References

PACKAGE

https://www.npmjs.com/package/@radivi-ui/react-dialog/v/1.1.3

PACKAGE

https://www.npmjs.com/package/@radivi-ui/react-dialog/v/1.1.4