{"answers":{"affected":"1 open source package ship an affected version, including whiteboard-agent.","exploited":"There is no known exploitation of MAL-2026-4729 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-4729 is a malicious package in whiteboard-agent, published on 19 May 2026."},"fix_prompt":"MAL-2026-4729 is a malicious package: whiteboard-agent (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-4729/ (Markdown: https://insights.sbomify.com/MAL-2026-4729/index.md)","id":"MAL-2026-4729","markdown":"https://insights.sbomify.com/MAL-2026-4729/index.md","name":"MAL-2026-4729","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On `npm install`, scripts/postinstall.js fetches a `companion-\u003cplatform\u003e-\u003carch\u003e` binary from `github.com/palmthree-studio/whiteboard-agent/releases/download/nightly/...` — a mutable release tag (not pinned to package version 1.4.24) with no SHA/signature verification — chmods it 0755, and in non-TTY installs (CI, agent, scripted environments) spawns it detached. The same non-TTY path generates an `admin` account with a random 16-hex password, starts the companion HTTP server on 127.0.0.1:3001 with `COMPANION_LOCALHOST_BYPASS=1`, then spawns `cloudflared tunnel --url http://localhost:3001`, publishing the local server to a public `*.trycloudflare.com` URL. The combination is install-time-triggered remote ingress: anyone who learns or guesses the tunnel URL can reach the companion API on the installer's host without authentication beyond the random credential, which is itself generated and stored locally without user notification. README documents `wendy start` performing tunnel exposure interactively, but does not warn that `npm install` itself does this silently in non-interactive environments — the typical CI / build-agent / container scenario. Independently, the `nightly` mutable-tag binary fetch means every install (and reinstall/update) pulls whatever bytes are at that tag at that moment; a stolen publish credential or a future malicious push compromises every installation without any version bump.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in whiteboard-agent (npm)","id":"MAL-2026-4729","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"whiteboard-agent","purl":"pkg:npm/whiteboard-agent","source":"MAL-2026-4729"}],"products":null,"published":"2026-05-19","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-4729/"}