{"id":"MAL-2026-18367","revision":"64506a4d8f3e4bdc960385852f603ffb","records":[{"revision":"64506a4d8f3e4bdc960385852f603ffb","observedAt":"2026-10-29T15:12:22.973+00:00","statement":{"source":"osv","id":"MAL-2026-18367","aliases":[],"title":"Malicious code in identity-two-factor (npm)","description":"identity-two-factor@999.0.0 is a dependency-confusion package aimed at Coinbase (its README and postinstall.js say so, and the beacon path is `cbhq-canary`) with no functional code. Its postinstall script runs `node postinstall.js` on npm install, which writes a marker file to the temp directory and POSTs the hostname, username, working-directory name, CI flag and Node version to `https://webhook.site/e0981a8e-081e-49a0-8b4a-235109e13045/cbhq-canary`. It was published by the npm account hologrammmm0x, which has no other packages.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f9adfaa94d0139573858f537ccd5f8eeb2fd452d18cfac057fd1bc6b38f8773c)\nOn npm install, postinstall.js collects os.hostname(), os.userInfo().username, the current working directory basename, a CI flag, and the Node version, and POSTs them to a hardcoded webhook.site URL (https://webhook.site/e0981a8e-081e-49a0-8b4a-235109e13045/cbhq-canary). The package is published at version 999.0.0 under a name that resembles an internal/private package, consistent with a dependency-confusion exfiltration payload: builds that resolve this public name over an intended private registry will automatically beacon identifying host and user metadata to a third-party collector endpoint. The in-source self-labeling as a 'security research canary' is author-controlled text and is not accompanied by any installer-visible authorization; the behavior itself is unsolicited data exfiltration from any machine that installs the package.\n","state":0,"publishedAt":"2026-10-28T06:56:31+00:00","modifiedAt":"2026-10-29T14:30:40.997539+00:00","affected":[{"ecosystem":"npm","name":"identity-two-factor","ranges":[],"versions":["999.0.0"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/identity-two-factor","https://www.npmjs.com/package/identity-two-factor/v/999.0.0"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-18367","license":"OSV · upstream source license applies","key":"osv:MAL-2026-18367","identifiers":["MAL-2026-18367"]},"retained":false,"historicalAffected":[]}],"coverage":[]}