# MAL-2026-10963: Malicious code in markscan-reports (npm)


- **Type:** Malicious package
- **Package:** `markscan-reports` (npm)
- **Published:** 20 Jul 2026

## What is MAL-2026-10963?

MAL-2026-10963 is a malicious package in markscan-reports, published on 20 Jul 2026. 

### Official description

The markscan-reports package was published to the npm registry by user 'jonothhu' (maintainer email bruemleveroger@gmail.com) as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped (@scope/name) forms so that a misconfigured resolver installs the public lookalike instead of an intended private/internal dependency. Each package self-describes as an 'AUTHORIZED SECURITY RESEARCH CANARY' (static token PATHC-CANARY-2026, contact farouqsa@proton.me), but ships an unconsented install-time beacon and provides no legitimate functionality.

The package declares a postinstall hook ("node postinstall.js") that executes automatically on npm install. The bundled postinstall.js collects host reconnaissance - the package/canary name, the static token 'PATHC-CANARY-2026', an event label, a UTC timestamp, the Node.js version, the current working directory, the platform, and os.hostname() - and exfiltrates it via HTTPS POST to a hardcoded anonymous dead-drop at https://webhook.site/129cb2ee-ba08-4b3c-989c-270dc0030350 (the same collector across all 19 packages). Request errors are swallowed.

The self-attestation of 'authorized security research' present in the package metadata is unverifiable and does not change the disposition: the package performs unconsented telemetry collection and exfiltration at install time to an anonymous collector, matching the behavior of a dependency-confusion reconnaissance beacon. Install-time behavior and the shared collector endpoint were confirmed by static analysis of a sample spanning all three namespaces and both scoped and unscoped variants.

## What should I do about MAL-2026-10963?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-10963 is a malicious package: markscan-reports (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-10963/ (Markdown: https://insights.sbomify.com/MAL-2026-10963/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-10963

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-10963/
Summaries are generated and may contain mistakes; the official description above is the record.