{"answers":{"affected":"1 open source package ship an affected version, including exodus-checkout.","exploited":"There is no known exploitation of MAL-2026-10894 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-10894 is a malicious package in exodus-checkout, published on 20 Jul 2026."},"fix_prompt":"MAL-2026-10894 is a malicious package: exodus-checkout (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-10894/ (Markdown: https://insights.sbomify.com/MAL-2026-10894/index.md)","id":"MAL-2026-10894","markdown":"https://insights.sbomify.com/MAL-2026-10894/index.md","name":"MAL-2026-10894","record":{"aliases":["GHSA-mqx8-fhj5-w597"],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Package `exodus-checkout` self-identifies as a security-research dependency-confusion proof-of-concept targeting an internal Exodus payments SDK. It mimics the internal API surface (`generateMnemonicSigningKeys`, `signCharge`, `signRefund`, `signCancelSubscription` in src/index.js), but every exported function throws — there is no functional implementation. On `npm install`, src/canary.js runs a postinstall hook that performs a DNS lookup and HTTPS GET to a hardcoded serveo SSH-tunnel host (`96e03fa6c292469a-172-245-86-254.serveousercontent.com/canary-install`), passing the package's own name and version as query parameters. No installer data (env vars, filesystem, credentials) is read or transmitted — the beacon carries only the package's own identity. Installer-side impact: any build that resolves `exodus-checkout` from public npm (whether by typo, dependency confusion, or accidental inclusion) breaks at runtime because all exports throw, and emits a one-way network signal to a researcher-controlled tunnel domain that is not Exodus infrastructure and cannot be audited by Exodus or the installer. Routing to human review: name-impersonation of a vendor's internal namespace plus an install-time outbound beacon is the dependency-confusion shape, but the absence of any data exfiltration or remote-code-execution mechanism keeps this below the active-attack threshold.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in exodus-checkout (npm)","id":"MAL-2026-10894","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"exodus-checkout","purl":"pkg:npm/exodus-checkout","source":"MAL-2026-10894"}],"products":null,"published":"2026-07-20","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-10894/"}