MAL-2026-18604

    Dashboard / Malicious Package / MAL-2026-18604

    MAL-2026-18604

    Published: 2 Nov 2026Last Modified: 4 Nov 2026

    Summary: Malicious code in @signals-notebook/annotation-editor (npm)

    Details: Runs on install. The preinstall script sends the output of `id` (the installing user's identity and groups), base64-encoded, to a request-bin host with curl. This is the dependency-confusion probe pattern; it leaks data from every machine that installs the package. Version examined: 2.2.60-630109c; tarball SHA-256 023e55d33ea70625a746ab25627ea450718c9db722988bd233d370c1587db248.

    References:

    Affected packages

    Package

    Name: @signals-notebook/annotation-editor

    Purl: pkg:npm/%40signals-notebook/annotation-editor

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.2.60-630109c