MAL-2026-18604

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@signals-notebook/annotation-editor/MAL-2026-18604.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18604
Published
2026-11-02T09:44:21Z
Modified
2026-11-04T09:00:06Z
Summary
Malicious code in @signals-notebook/annotation-editor (npm)
Details

Runs on install. The preinstall script sends the output of id (the installing user's identity and groups), base64-encoded, to a request-bin host with curl. This is the dependency-confusion probe pattern; it leaks data from every machine that installs the package. Version examined: 2.2.60-630109c; tarball SHA-256 023e55d33ea70625a746ab25627ea450718c9db722988bd233d370c1587db248.

Credits

Affected packages

npm / @signals-notebook/annotation-editor

Package

Name
@signals-notebook/annotation-editor
View open source insights on deps.dev
Purl
pkg:npm/%40signals-notebook/annotation-editor

Affected ranges

Affected versions

2.*
2.2.60-630109c

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@signals-notebook/annotation-editor/MAL-2026-18604.json"