{
  "schema_version": "1.6.0",
  "id": "CLR-2026-2993",
  "modified": "2026-06-25T20:16:00Z",
  "published": "2026-06-25T20:16:00Z",
  "summary": "Cloud-credential theft disguised as a React colour picker",
  "details": "The npm package colorpicker-ui@1.2.5 advertised itself as a \"Minimal color picker component for React.\" Its postinstall hook instead queries the cloud instance-metadata service (169.254.169.254) — the endpoint that hands out temporary IAM credentials to code running on AWS/GCP/Azure. A different technique from the download-execute droppers, aimed squarely at stealing cloud credentials from CI runners. Catalogued in OSV as MAL-2026-6473; surfaced independently by codelake's dropper pipeline.",
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "colorpicker-ui"
      },
      "versions": [
        "1.2.5"
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://research.codelake.dev/advisories/clr-2026-2993-colorpicker-ui"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/MAL-2026-6473"
    }
  ],
  "credits": [
    {
      "name": "Sascha Klein, codelake Research",
      "type": "FINDER",
      "contact": [
        "https://research.codelake.dev"
      ]
    }
  ],
  "database_specific": {
    "caseId": "CLR-2026-2993",
    "kind": "malware",
    "severity": "Critical",
    "status": "Confirmed malicious",
    "iocs": {
      "ips": [
        "169.254.169.254"
      ],
      "hashes": [
        "sha256:d4987564f0ec034ad1e55937e2d5f559fc96241dd973fe87392c763ea5b1914b"
      ],
      "indicators": [
        "169.254.169.254 (cloud instance-metadata service / IMDS — credential-theft target)",
        "postinstall → node setup.js (queries the metadata endpoint on install)",
        "colorpicker-ui@1.2.5 (npm) — impersonates a \"Minimal color picker component for React\"; 4 files, no repo, no deps",
        "d4987564f0ec034ad1e55937e2d5f559fc96241dd973fe87392c763ea5b1914b · colorpicker-ui-1.2.5.tgz",
        "OSV MAL-2026-6473 (published 2026-06-25) — https://osv.dev/vulnerability/MAL-2026-6473"
      ]
    }
  }
}