MAL-2026-18367

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/identity-two-factor/MAL-2026-18367.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18367
Published
2026-10-28T06:56:31Z
Modified
2026-10-29T08:45:05Z
Summary
Malicious code in identity-two-factor (npm)
Details

identity-two-factor@999.0.0 is a dependency-confusion package aimed at Coinbase (its README and postinstall.js say so, and the beacon path is cbhq-canary) with no functional code. Its postinstall script runs node postinstall.js on npm install, which writes a marker file to the temp directory and POSTs the hostname, username, working-directory name, CI flag and Node version to https://webhook.site/e0981a8e-081e-49a0-8b4a-235109e13045/cbhq-canary. It was published by the npm account hologrammmm0x, which has no other packages.

Database specific 
{
    "iocs":  {
        "files":  [
            {
                "digests":  {
                    "sha256":  "57f5633f530f90a6e50a2e33f6bb33624952f83ab090ac843978cc9cc55f9ec8"
                },
                "note":  "postinstall runs `node postinstall.js`, which POSTs hostname and username to webhook.site (identity-two-factor@999.0.0).",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "182bd20d54e19e3b3dfc34c7bd0c4c9ed0bfb2845eaa01a6e52258d53ae36462"
                },
                "note":  "Executed by the postinstall script of identity-two-factor@999.0.0.",
                "paths":  [
                    "postinstall.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            }
        ],
        "urls":  [
            "https://webhook.site/e0981a8e-081e-49a0-8b4a-235109e13045/cbhq-canary"
        ]
    }
}
References
Credits

Affected packages

npm / identity-two-factor

Package

Name
identity-two-factor
View open source insights on deps.dev
Purl
pkg:npm/identity-two-factor

Affected ranges

Affected versions

999.*
999.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/identity-two-factor/MAL-2026-18367.json"