orderly-plugin-liquidity-heatmap@1.0.0
Adds a liquidity heatmap overlay to the Orderly orderbook widget
OpenSSF/OSV Malicious Advisory
imported 10d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-17848 confirms this npm version as malicious.
Advisory
MAL-2026-17848
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in orderly-plugin-liquidity-heatmap (npm)
Details
orderly-plugin-liquidity-heatmap poses as a liquidity heatmap plugin for the Orderly Network orderbook widget, but its only export is an empty stub and a postinstall hook runs `node ./scripts/setup.js` on npm install. When the script detects GitHub Actions (CI and GITHUB_WORKSPACE set), it records the runner's host, user, repository, GITHUB_/ACTIONS_/RUNNER_ variable names, GITHUB_TOKEN presence and length and network egress, and requests an OIDC token from ACTIONS_ID_TOKEN_REQUEST_URL. From 1.0.2 it uses the workflow's GITHUB_TOKEN to commit heatmap-setup-report.json to the default branch of the installing repository, and 1.0.4 also force-pushes a `heatmap-setup-<timestamp>` git tag with the credentials actions/checkout persists in .git/config; 1.0.6 ships the same setup.js as 1.0.4. The npm account dumtban published the six versions between 13:12 and 16:05 UTC on 2026-10-11, each extending the previous one's access to the CI runner.
References
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
The postinstall hook performs unnecessary CI metadata collection and writes a report into the consumer workspace, creating a real but unresolved disclosure risk if that workspace is later committed. The inspected source does not establish an external exfiltration path, so this warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Installing the package in an environment with both CI and GITHUB_WORKSPACE set.
Impact
The report leaves CI-identifying data in the consumer repository workspace and could be retained if the workflow commits it. No external disclosure of the report was established.
Mechanism
The hook gathers host, user, repository, workflow, and runner metadata, then writes a JSON report in the workspace. If OIDC request variables are present, it uses the supplied request URL and token for an audience request to api.github.com.
AI rationale
The postinstall hook performs unnecessary CI metadata collection and writes a report into the consumer workspace, creating a real but unresolved disclosure risk if that workspace is later committed. The inspected source does not establish an external exfiltration path, so this warrants a warning rather than a block.
Evidence
package.jsonscripts/setup.jsheatmap-setup-report.json
Network endpoints4
registry.npmjs.orgapi.github.comgithub.comobjects.githubusercontent.com
Independent scan evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for AI warning decision
- The package runs scripts/setup.js as its postinstall hook.
- The setup script records runner, user, workspace, repository, and workflow details.
- The script targets a heatmap-setup-report.json file in the GitHub workspace and writes the collected report there.
- When GitHub Actions OIDC request variables exist, the script makes an authenticated request using the supplied URL and discards the response body.
- The published runtime entrypoint returns a no-op cleanup function.
Evidence against
- The inspected setup script contains no upload of the collected report to an unrelated host.
- The OIDC request is conditional on GitHub Actions variables and uses their supplied URL; the response body is discarded.
- The package runtime entrypoint does not perform the setup behavior.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./scripts/setup.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg8"postinstall": "node ./scripts/setup.js"
},
"keywords": ["orderly", "plugin", "orderbook", "heatmap"],
"license":
High
Suspicious Lifecycle Evidence
The package runs scripts/setup.js as its postinstall hook.
package.jsonView on unpkg · L8scripts/setup.jsView file
4Manifest entrypoint (scripts.postinstall) carries capability families absent from dist/build output: environment+network, execution+network
L4: const path = require("path");
L5: const { execSync } = require("child_process");
L6:
L7: const isCI = !!process.env.CI && !!process.env.GITHUB_WORKSPACE;
L8: if (!isCI) {
...
L14: capturedAt: new Date().toISOString(),
L15: host: os.hostname(),
L16: platform: `${os.type()} ${os.release()}`,
...
L38: const probes = [
L39: { name: "registry.npmjs.org", cmd: "curl -s -o /dev/null -w %{http_code} -m 5 https://registry.npmjs.org/" },
L40: { name: "api.github.com", cmd: "curl -s -o /dev/null -w %{http_code} -m 5 https://api.github.com/" },
Findings
6 High2 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighEntrypoint Build Divergencescripts/setup.js
HighSandbox Evasion Gated Capabilityscripts/setup.js
HighPrevious Version Dangerous Deltascripts/setup.js
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidencescripts/setup.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to orderly-plugin-liquidity-heatmap@1.0.0.
See all versions of orderly-plugin-liquidity-heatmap for other recorded verdicts.
- Avoid installing orderly-plugin-liquidity-heatmap@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.