Malicious code in identity-two-factor (npm)

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

[email protected] is a dependency-confusion package aimed at Coinbase (its README and postinstall.js say so, and the beacon path is `cbhq-canary`) with no functional code. Its postinstall script runs `node postinstall.js` on npm install, which writes a marker file to the temp directory and POSTs the hostname, username, working-directory name, CI flag and Node version to `https://webhook.site/e0981a8e-081e-49a0-8b4a-235109e13045/cbhq-canary`. It was published by the npm account hologrammmm0x, which has no other packages. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f9adfaa94d0139573858f537ccd5f8eeb2fd452d18cfac057fd1bc6b38f8773c) On npm install, postinstall.js collects os.hostname(), os.userInfo().username, the current working directory basename, a CI flag, and the Node version, and POSTs them to a hardcoded webhook.site URL (https://webhook.site/e0981a8e-081e-49a0-8b4a-235109e13045/cbhq-canary). The package is published at version 999.0.0 under a name that resembles an internal/private package, consistent with a dependency-confusion exfiltration payload: builds that resolve this public name over an intended private registry will automatically beacon identifying host and user metadata to a third-party collector endpoint. The in-source self-labeling as a 'security research canary' is author-controlled text and is not accompanied by any installer-visible authorization; the behavior itself is unsolicited data exfiltration from any machine that installs the package.

Source published

28 Oct 2026 06:56:31 UTC

Source modified

29 Oct 2026 14:30:40 UTC

Observed here

29 Oct 2026 15:12:22 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.