MAL-2026-14135

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@mohamed_nowisar/token3-check/MAL-2026-14135.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14135
Published
2026-08-18T23:06:02Z
Modified
2026-08-18T23:15:11.569977920Z
Summary
Malicious code in @mohamed_nowisar/token3-check (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (10d463b1de43a90878da858dd595dadf43fcbbbb9d2e26cfd8b14ff6e0167457)

The package registers preinstall, install, and postinstall lifecycle hooks that all execute beacon.js. On any npm install, beacon.js collects the installer's hostname (os.hostname()), username (os.userInfo().username), current working directory (process.cwd()), platform/arch, Node.js version, and a curated set of CI-detection environment variables (including YANDEXCI, GITHUBACTIONS, GITLABCI, JENKINSURL) and POSTs them via https.request to a hardcoded endpoint at https://webhook.site/3687e44a-4e97-43c4-84c9-e6c93d4b2fbc. The package self-describes as a dependency-confusion canary targeting the Yandex build pipeline, but installers do not opt in to the beacon and the destination is a third-party inspection endpoint controlled by the publisher. Internal build-system identity and CI fingerprints leaked this way enable follow-on dependency-confusion attacks against the exposed pipelines.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-18T23:09:42.1253467Z",
            "sha256": "10d463b1de43a90878da858dd595dadf43fcbbbb9d2e26cfd8b14ff6e0167457",
            "modified_time": "2026-08-18T23:06:02Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018179",
            "versions": [
                "0.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @mohamed_nowisar/token3-check

Package

Name
@mohamed_nowisar/token3-check
View open source insights on deps.dev
Purl
pkg:npm/%40mohamed_nowisar/token3-check

Affected ranges

Affected versions

0.*
0.0.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@mohamed_nowisar/token3-check/MAL-2026-14135.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "167a36231c590174e7081a5ab2820fde2f87d6a3ce9a004c447afe749dd3f049",
            "tlsh": "463120b9c36848710af507e1b76c2407a67af0763b8679b0b13662447fcc2b9013e1ab",
            "path": "beacon.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "token3-check-0.0.1.tgz",
            "hashes": {
                "sha1": "733f3d7ca81332aa2befd98f011ee1cb6a323911",
                "sha512_sri": "sha512-EEYeYya65V6cL3wmN9MauUu+sIBofT7V4+BHJOHMoWbWUGbTnVnwJai2nqQtoAyP9NqtQ2+t7dxP8UpjDF8D5w=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]