MAL-2026-4589 Malicious code in itc-actors-api (npm)
Malicious package
Published
MAL-2026-4589 is a malicious package: itc-actors-api (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-4589/ (Markdown: https://insights.sbomify.com/MAL-2026-4589/index.md)
- Package
- itc-actors-api
- Registry
- npm
What is MAL-2026-4589?
MAL-2026-4589 is a malicious package in itc-actors-api, published on 25 May 2026.
Official description
The package contains callback.js which collects host identifiers and user information (os.hostname(), os.userInfo(), os.platform(), cwd) and transmits them via an HTTPS request. The file structures the collected data with fields like hostname, username, and cwd — the canonical reconnaissance-beacon shape used by dependency-confusion / supply-chain reconnaissance campaigns. The package name and 99.0.0 version (a high-version-number pattern typical of dependency-confusion attacks targeting internal package names) further corroborate malicious intent. Installing or loading this package leaks identifying information about the installer's machine to an external endpoint.
What should I do about MAL-2026-4589?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.