aliftech-uinpm
Advisory published Updated
aliftech-ui is a confirmed malicious npm package (MAL-2026-17156) that opens a backdoor for remote access (malicious version 99.9.9). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in aliftech-ui (npm)
What this malware does
postinstall.js runs automatically on npm install and reads os.hostname() and os.userInfo().username, then issues an https.get to a hardcoded webhook.site collector URL (https://webhook.site/539f8bb9-497a-4104-92f7-f95a77204cc2/<hostname>/<username>), embedding the installer identifiers in the URL path. The package name mimics an organization prefix and is published at version 99.9.9, a shape consistent with dependency-confusion targeting of an internal package name; installing it causes any resolving build (including CI) to beacon identifying host and account data to an anonymous third-party collector.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Backdoor / remote accessFind it
Search your lockfiles and build artifacts for aliftech-ui (version 99.9.9).
If you installed it — respond
aliftech-ui establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.
Did it already run?
If aliftech-ui was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks aliftech-ui-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.