OpenSSF/OSV advisory MAL-2026-14134 confirms this npm version as malicious. On `npm install`, the package's preinstall hook runs `node beacon.js`, which collects host identity (os.hostname(), os.userInfo().username, process.cwd(), platform, arch, Node version) and CI-detection environment variables (GITLAB_CI, GITHUB_ACTIONS, YANDEX_CI, and others) and POSTs them as JSON to the hardcoded endpoint https://webhook.site/3687e44a-4e97-43c4-84c9-e6c93d4b2fbc...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @mohamed_nowisar/depconf-canary-test (npm)
Details
On `npm install`, the package's preinstall hook runs `node beacon.js`, which collects host identity (os.hostname(), os.userInfo().username, process.cwd(), platform, arch, Node version) and CI-detection environment variables (GITLAB_CI, GITHUB_ACTIONS, YANDEX_CI, and others) and POSTs them as JSON to the hardcoded endpoint https://webhook.site/3687e44a-4e97-43c4-84c9-e6c93d4b2fbc. The package name and self-description frame this as a dependency-confusion canary, but the beacon fires automatically on install without opt-in and sends installer-side data to an author-controlled webhook.site collector.
Decision reason
OpenSSF Malicious Packages via OSV confirms @mohamed_nowisar/depconf-canary-test@0.0.1 as malicious (MAL-2026-14134): Malicious code in @mohamed_nowisar/depconf-canary-test (npm)