# MAL-2026-10894: Malicious code in exodus-checkout (npm)


- **Type:** Malicious package
- **Package:** `exodus-checkout` (npm)
- **Published:** 20 Jul 2026
- **Also known as:** GHSA-mqx8-fhj5-w597

## What is MAL-2026-10894?

MAL-2026-10894 is a malicious package in exodus-checkout, published on 20 Jul 2026. 

### Official description

Package `exodus-checkout` self-identifies as a security-research dependency-confusion proof-of-concept targeting an internal Exodus payments SDK. It mimics the internal API surface (`generateMnemonicSigningKeys`, `signCharge`, `signRefund`, `signCancelSubscription` in src/index.js), but every exported function throws — there is no functional implementation. On `npm install`, src/canary.js runs a postinstall hook that performs a DNS lookup and HTTPS GET to a hardcoded serveo SSH-tunnel host (`96e03fa6c292469a-172-245-86-254.serveousercontent.com/canary-install`), passing the package's own name and version as query parameters. No installer data (env vars, filesystem, credentials) is read or transmitted — the beacon carries only the package's own identity. Installer-side impact: any build that resolves `exodus-checkout` from public npm (whether by typo, dependency confusion, or accidental inclusion) breaks at runtime because all exports throw, and emits a one-way network signal to a researcher-controlled tunnel domain that is not Exodus infrastructure and cannot be audited by Exodus or the installer. Routing to human review: name-impersonation of a vendor's internal namespace plus an install-time outbound beacon is the dependency-confusion shape, but the absence of any data exfiltration or remote-code-execution mechanism keeps this below the active-attack threshold.

## What should I do about MAL-2026-10894?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-10894 is a malicious package: exodus-checkout (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-10894/ (Markdown: https://insights.sbomify.com/MAL-2026-10894/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-10894

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-10894/
Summaries are generated and may contain mistakes; the official description above is the record.