MAL-2026-18367 Malicious code in identity-two-factor (npm)

[email protected] is a dependency-confusion package aimed at Coinbase (its README and postinstall.js say so, and the beacon path is cbhq-canary) with no functional code. Its postinstall script runs node postinstall.js on npm install, which writes a marker file to the temp directory and POSTs the hostname, username, working-directory name, CI flag and Node version to https://webhook.site/e0981a8e-081e-49a0-8b4a-235109e13045/cbhq-canary. It was published by the npm account hologrammmm0x, which has no other packages.

On npm install, postinstall.js collects os.hostname(), os.userInfo().username, the current working directory basename, a CI flag, and the Node version, and POSTs them to a hardcoded webhook.site URL (https://webhook.site/e0981a8e-081e-49a0-8b4a-235109e13045/cbhq-canary). The package is published at version 999.0.0 under a name that resembles an internal/private package, consistent with a dependency-confusion exfiltration payload: builds that resolve this public name over an intended private registry will automatically beacon identifying host and user metadata to a third-party collector endpoint. The in-source self-labeling as a 'security research canary' is author-controlled text and is not accompanied by any installer-visible authorization; the behavior itself is unsolicited data exfiltration from any machine that installs the package.