MAL-2026-17848

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/orderly-plugin-liquidity-heatmap/MAL-2026-17848.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17848
Published
2026-10-11T13:13:56Z
Modified
2026-10-13T06:30:05Z
Summary
Malicious code in orderly-plugin-liquidity-heatmap (npm)
Details

orderly-plugin-liquidity-heatmap poses as a liquidity heatmap plugin for the Orderly Network orderbook widget, but its only export is an empty stub and a postinstall hook runs node ./scripts/setup.js on npm install. When the script detects GitHub Actions (CI and GITHUB_WORKSPACE set), it records the runner's host, user, repository, GITHUB_/ACTIONS_/RUNNER_ variable names, GITHUB_TOKEN presence and length and network egress, and requests an OIDC token from ACTIONS_ID_TOKEN_REQUEST_URL. From 1.0.2 it uses the workflow's GITHUB_TOKEN to commit heatmap-setup-report.json to the default branch of the installing repository, and 1.0.4 also force-pushes a heatmap-setup-<timestamp> git tag with the credentials actions/checkout persists in .git/config; 1.0.6 ships the same setup.js as 1.0.4. The npm account dumtban published the six versions between 13:12 and 16:05 UTC on 2026-10-11, each extending the previous one's access to the CI runner.

Database specific 
{
    "iocs":  {
        "files":  [
            {
                "note":  "Runner fingerprint written to GITHUB_WORKSPACE and, from 1.0.2, committed to the repository's default branch via the GitHub contents API.",
                "paths":  [
                    "heatmap-setup-report.json"
                ],
                "source":  "DROPPED"
            },
            {
                "note":  "Execution trace appended in os.tmpdir() from 1.0.3.",
                "paths":  [
                    "heatmap-exec-trace.log"
                ],
                "source":  "DROPPED"
            },
            {
                "digests":  {
                    "sha256":  "44cfa921b8a56d5a79a05052a4baf85e0ec3f5a2e1ee2da064d1ca61a4451f47"
                },
                "note":  "postinstall hook runs scripts/setup.js, which fingerprints GitHub Actions runners and abuses GITHUB_TOKEN.",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "39124ff7c434292b11cf607575bae99402d0afd30782a4456b858a35410b2d60"
                },
                "note":  "Executed by the postinstall script.",
                "paths":  [
                    "scripts/setup.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "85bce265963d453cd92e88d1ae17ac0906404c91578a00c766bfa1b69aef5cd3"
                },
                "note":  "postinstall hook runs scripts/setup.js, which fingerprints GitHub Actions runners and abuses GITHUB_TOKEN.",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "ef6413b0617623a5302ec74a086de20b59bc60da939cc85a6a165630b7fbf474"
                },
                "note":  "Executed by the postinstall script.",
                "paths":  [
                    "scripts/setup.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "57c5a826212d16a686e4c829fabce9193dc8375deeea07ee24481aa62a36e27e"
                },
                "note":  "postinstall hook runs scripts/setup.js, which fingerprints GitHub Actions runners and abuses GITHUB_TOKEN.",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "b251328db56336ed92fbb0eca68b5ca1b641a9ccdc51020c9af85e475156e5c2"
                },
                "note":  "Executed by the postinstall script.",
                "paths":  [
                    "scripts/setup.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "fb77c56b715e118d311819543efbafa5b099d008585c2e23a39e1958896c5adf"
                },
                "note":  "postinstall hook runs scripts/setup.js, which fingerprints GitHub Actions runners and abuses GITHUB_TOKEN.",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "b4c09dde74153448c4e2284092cd7f664ff26c066f932e2ccf4ea6786b7d6394"
                },
                "note":  "Executed by the postinstall script.",
                "paths":  [
                    "scripts/setup.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "d65e79e4989232b754e739b8ccfd7e89bf0e67dfbd0758e0153da4d5dd13e915"
                },
                "note":  "postinstall hook runs scripts/setup.js, which fingerprints GitHub Actions runners and abuses GITHUB_TOKEN.",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "6084592cd6948afb3b45bbeca20f9c9e5364961cf4bb522366d15ce6db2f33eb"
                },
                "note":  "Executed by the postinstall script.",
                "paths":  [
                    "scripts/setup.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "06e624fe1b1554137b9dd628887246764b37cc8f87f12501324b87710ee42091"
                },
                "note":  "postinstall hook runs scripts/setup.js, which fingerprints GitHub Actions runners and abuses GITHUB_TOKEN.",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            }
        ]
    }
}
References
Credits

Affected packages

npm / orderly-plugin-liquidity-heatmap

Package

Name
orderly-plugin-liquidity-heatmap
View open source insights on deps.dev
Purl
pkg:npm/orderly-plugin-liquidity-heatmap

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.6

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/orderly-plugin-liquidity-heatmap/MAL-2026-17848.json"