MAL-2026-14135
Malicious code in @mohamed_nowisar/token3-check (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (10d463b1de43a90878da858dd595dadf43fcbbbb9d2e26cfd8b14ff6e0167457) The package registers preinstall, install, and postinstall lifecycle hooks that all execute beacon.js. On any npm install, beacon.js collects the installer's hostname (os.hostname()), username (os.userInfo().username), current working directory (process.cwd()), platform/arch, Node.js version, and a curated set of CI-detection environment variables (including YANDEX_CI, GITHUB_ACTIONS, GITLAB_CI, JENKINS_URL) and POSTs them via https.request to a hardcoded endpoint at https://webhook.site/3687e44a-4e97-43c4-84c9-e6c93d4b2fbc. The package self-describes as a dependency-confusion canary targeting the Yandex build pipeline, but installers do not opt in to the beacon and the destination is a third-party inspection endpoint controlled by the publisher. Internal build-system identity and CI fingerprints leaked this way enable follow-on dependency-confusion attacks against the exposed pipelines.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for @mohamed_nowisar/token3-check (npm). Pin to a known-safe version or switch to an alternative.