MAL-2026-13626
Malicious code in @mrbenty8jf1p9y5/oidc-bind-canary (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (1a9ed4acf296e53ad5955f759a0f0692d641781b1bd4e67ada1c116216f96fc3) The package's postinstall lifecycle script issues an HTTPS request from the installer's machine to a Cloudflare tunnel at wiki-shared-carlos-exempt.trycloudflare.com on path /token-capture. The request is sent with the Host header spoofed to dependabot-api.githubapp.com and with TLS certificate validation disabled (rejectUnauthorized:false), disguising the callout as legitimate GitHub Dependabot traffic. The destination path name (/token-capture) and the disguise mechanics indicate an install-time beacon to an attacker-controlled listener, firing automatically on npm install.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for @mrbenty8jf1p9y5/oidc-bind-canary (npm). Pin to a known-safe version or switch to an alternative.