MAL-2026-14135

    Dashboard / Malicious Package / MAL-2026-14135

    MAL-2026-14135

    Published: 18 Aug 2026Last Modified: 18 Aug 2026

    Summary: Malicious code in @mohamed_nowisar/token3-check (npm)

    Details: Source: amazon-inspector (10d463b1de43a90878da858dd595dadf43fcbbbb9d2e26cfd8b14ff6e0167457) The package registers preinstall, install, and postinstall lifecycle hooks that all execute beacon.js. On any npm install, beacon.js collects the installer's hostname (os.hostname()), username (os.userInfo().username), current working directory (process.cwd()), platform/arch, Node.js version, and a curated set of CI-detection environment variables (including YANDEX_CI, GITHUB_ACTIONS, GITLAB_CI, JENKINS_URL) and POSTs them via https.request to a hardcoded endpoint at https://webhook.site/3687e44a-4e97-43c4-84c9-e6c93d4b2fbc. The package self-describes as a dependency-confusion canary targeting the Yandex build pipeline, but installers do not opt in to the beacon and the destination is a third-party inspection endpoint controlled by the publisher. Internal build-system identity and CI fingerprints leaked this way enable follow-on dependency-confusion attacks against the exposed pipelines.

    References: https://www.npmjs.com/package/@mohamed_nowisar/token3-check/v/0.0.1

    Affected packages

    Package

    Name: @mohamed_nowisar/token3-check

    Purl: pkg:npm/%40mohamed_nowisar/token3-check

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.0.1
    MAL-2026-14135 | CVE-DB