{"id":"MAL-2026-18367","kind":"package","aliases":["MAL-2026-18367"],"related":[],"title":"Malicious code in identity-two-factor (npm)","description":"identity-two-factor@999.0.0 is a dependency-confusion package aimed at Coinbase (its README and postinstall.js say so, and the beacon path is `cbhq-canary`) with no functional code. Its postinstall script runs `node postinstall.js` on npm install, which writes a marker file to the temp directory and POSTs the hostname, username, working-directory name, CI flag and Node version to `https://webhook.site/e0981a8e-081e-49a0-8b4a-235109e13045/cbhq-canary`. It was published by the npm account hologrammmm0x, which has no other packages.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"identity-two-factor","fixed":[],"affected":"= 999.0.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-28T06:56:31+00:00","first_seen_at":"2026-10-29T08:53:19+00:00","triaged_at":"2026-10-29T08:53:34+00:00","updated_at":"2026-10-29T08:55:57+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-18367':11A,14A '-2026':10A,13A '/e0981a8e-081e-49a0-8b4a-235109e13045/cbhq-canary':88C '999.0.0':25C 'account':95C 'aim':32C 'beacon':43C 'canari':48C 'cbhq':47C 'cbhq-canari':46C 'ci':80C 'code':2A,52C 'coinbas':34C 'confus':30C 'depend':29C 'dependency-confus':28C 'directori':70C,78C 'factor':7A,18A,24C 'file':66C 'flag':81C 'function':51C 'hologrammmm0x':96C 'hostnam':74C 'ident':5A,22C 'identity':16A 'identity-two-factor':4A,15A,21C 'instal':61C 'mal':9A,12A 'malici':1A,19B 'marker':65C 'name':79C 'node':57C,83C 'npm':8A,60C,94C 'packag':20B,31C,101C 'path':44C 'post':72C 'postinstal':54C 'postinstall.js':38C,58C 'publish':91C 'readm':36C 'run':56C 'say':39C 'script':55C 'temp':69C 'two':6A,17A,23C 'usernam':75C 'version':84C 'webhook.site':87C 'webhook.site/e0981a8e-081e-49a0-8b4a-235109e13045/cbhq-canary':86C 'work':77C 'working-directori':76C 'write':63C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-28T06:56:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18367","url":"https://osv.dev/vulnerability/MAL-2026-18367","severity":"critical","published_at":"2026-10-28T06:56:31+00:00","modified_at":"2026-10-29T08:45:05+00:00","first_seen_at":"2026-10-29T08:53:19+00:00","fetched_at":"2026-10-29T08:53:19+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}