MAL-2026-10895

    Dashboard / Malicious Package / MAL-2026-10895

    MAL-2026-10895

    Published: 20 Jul 2026Last Modified: 1 Sept 2026Aliases: 
    GHSA-hrvv-3w2f-pp24

    Summary: Malicious code in exodus-payments (npm)

    Details: Source: amazon-inspector (51394e5297d9dc765ee318eabd49e400b9f843c342ed91e3df9bd9befc84254e) Package is self-identified as a dependency-confusion proof-of-concept. Its postinstall hook (src/canary.js) performs a DNS lookup and HTTPS GET to a hardcoded Serveo tunnel host (96e03fa6c292469a-172-245-86-254.serveousercontent.com), sending only the package's own name and version as query parameters. No environment variables, credentials, filesystem contents, or other installer data are read or transmitted; the only signal the operator gains is the installer's public egress IP from the inbound request metadata. README discloses the canary purpose. Concerns: install-time outbound network without opt-out (breaks air-gapped/sandboxed CI), destination is a third-party mutable tunneling endpoint rather than publisher-owned infrastructure, and the canary version coordinate (99.0.0-canary.1) is shaped to win dependency-confusion races against private packages. No credential theft, no code execution of remote content, no persistence.

    References: https://www.npmjs.com/package/exodus-payments/v/99.0.0-canary.1, https://github.com/advisories/GHSA-hrvv-3w2f-pp24

    Affected packages

    Package

    Name: exodus-payments

    Purl: pkg:npm/exodus-payments

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.0.0-canary.1
    MAL-2026-10895 | CVE-DB