OpenSSF/OSV advisory MAL-2026-14135 confirms this npm version as malicious. The package registers preinstall, install, and postinstall lifecycle hooks that all execute beacon.js. On any npm install, beacon.js collects the installer's hostname (os.hostname()), username (os.userInfo().username), current working directory (process.cwd()), platform/arch, Node.js version, and a curated set of CI-detection environment variables (including YANDEX_CI, GITHUB_ACTIONS, GITLAB_CI, JENKINS_URL) and...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @mohamed_nowisar/token3-check (npm)
Details
The package registers preinstall, install, and postinstall lifecycle hooks that all execute beacon.js. On any npm install, beacon.js collects the installer's hostname (os.hostname()), username (os.userInfo().username), current working directory (process.cwd()), platform/arch, Node.js version, and a curated set of CI-detection environment variables (including YANDEX_CI, GITHUB_ACTIONS, GITLAB_CI, JENKINS_URL) and POSTs them via https.request to a hardcoded endpoint at https://webhook.site/3687e44a-4e97-43c4-84c9-e6c93d4b2fbc. The package self-describes as a dependency-confusion canary targeting the Yandex build pipeline, but installers do not opt in to the beacon and the destination is a third-party inspection endpoint controlled by the publisher. Internal build-system identity and CI fingerprints leaked this way enable follow-on dependency-confusion attacks against the exposed pipelines.
Decision reason
OpenSSF Malicious Packages via OSV confirms @mohamed_nowisar/token3-check@0.0.1 as malicious (MAL-2026-14135): Malicious code in @mohamed_nowisar/token3-check (npm)