{"id":"MAL-2026-18367","revision":"e136a2bafe8140f185827b6e58b3a2f7","records":[{"revision":"e136a2bafe8140f185827b6e58b3a2f7","observedAt":"2026-10-29T09:48:08.617+00:00","statement":{"source":"osv","id":"MAL-2026-18367","aliases":[],"title":"Malicious code in identity-two-factor (npm)","description":"identity-two-factor@999.0.0 is a dependency-confusion package aimed at Coinbase (its README and postinstall.js say so, and the beacon path is `cbhq-canary`) with no functional code. Its postinstall script runs `node postinstall.js` on npm install, which writes a marker file to the temp directory and POSTs the hostname, username, working-directory name, CI flag and Node version to `https://webhook.site/e0981a8e-081e-49a0-8b4a-235109e13045/cbhq-canary`. It was published by the npm account hologrammmm0x, which has no other packages.","state":0,"publishedAt":"2026-10-28T06:56:31+00:00","modifiedAt":"2026-10-29T08:45:05.5738962+00:00","affected":[{"ecosystem":"npm","name":"identity-two-factor","ranges":[],"versions":["999.0.0"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/identity-two-factor"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-18367","license":"OSV · upstream source license applies","key":"osv:MAL-2026-18367","identifiers":["MAL-2026-18367"]},"retained":false,"historicalAffected":[]}],"coverage":[]}