CURSE-ALLIES-MODULE · MAL-2026-19223 · Package
UNINSTALL IT, ROTATE THE KEYS IT COULD READ
Not triaged yet. The sources’ own description is below.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Unknown from the sources.
Unknown from the sources.
-= Per source details. Do not edit below this line.=-
On npm install, the package runs a postinstall lifecycle script (node probe.cjs) that issues an HTTPS POST to a hardcoded webhook.site collector URL (https://webhook.site/a4bf0f9f-6d96-46e6-80ac-b76a5329f481) with the marker string CURSE_DEPENDENT_REMOTE_INSTALL_PROBE. The beacon fires unconditionally at install time with no configuration or opt-out, signaling to a third-party collector that the package resolved and executed inside the installer's environment. This is the canonical dependency-confusion / reconnaissance canary shape: the attacker learns that a given name resolves on the target's internal build infrastructure, enabling follow-on targeted attacks against environments where the name was expected to resolve privately.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.