orderly-plugin-liquidity-heatmap@1.0.1
Adds a liquidity heatmap overlay to the Orderly orderbook widget
OpenSSF/OSV Malicious Advisory
imported 10d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-17848 confirms this npm version as malicious.
Advisory
MAL-2026-17848
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in orderly-plugin-liquidity-heatmap (npm)
Details
orderly-plugin-liquidity-heatmap poses as a liquidity heatmap plugin for the Orderly Network orderbook widget, but its only export is an empty stub and a postinstall hook runs `node ./scripts/setup.js` on npm install. When the script detects GitHub Actions (CI and GITHUB_WORKSPACE set), it records the runner's host, user, repository, GITHUB_/ACTIONS_/RUNNER_ variable names, GITHUB_TOKEN presence and length and network egress, and requests an OIDC token from ACTIONS_ID_TOKEN_REQUEST_URL. From 1.0.2 it uses the workflow's GITHUB_TOKEN to commit heatmap-setup-report.json to the default branch of the installing repository, and 1.0.4 also force-pushes a `heatmap-setup-<timestamp>` git tag with the credentials actions/checkout persists in .git/config; 1.0.6 ships the same setup.js as 1.0.4. The npm account dumtban published the six versions between 13:12 and 16:05 UTC on 2026-10-11, each extending the previous one's access to the CI runner.
References
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
The automatic CI-only metadata collection is unrelated to the plugin’s runtime entrypoint and is not clearly described by the setup documentation. Since the inspected code keeps the snapshot in the consumer workspace and workflow output rather than sending it to an unrelated recipient, classify this as suspicious, not malicious.
Static reason
One or more suspicious static signals were detected.
Trigger
Package installation in a CI environment with GITHUB_WORKSPACE set.
Impact
Collected CI details may remain in workspace files or workflow output; no token value or snapshot is sent to a publisher-controlled endpoint in the inspected source.
Mechanism
The hook records machine, user, repository, workflow, runner, selected environment-key names, and token metadata, then writes the snapshot to the workspace and GitHub Actions summary and notice output.
AI rationale
The automatic CI-only metadata collection is unrelated to the plugin’s runtime entrypoint and is not clearly described by the setup documentation. Since the inspected code keeps the snapshot in the consumer workspace and workflow output rather than sending it to an unrelated recipient, classify this as suspicious, not malicious.
Evidence
package.jsonscripts/setup.jsheatmap-setup-report.json
Network endpoints4
registry.npmjs.orgapi.github.comgithub.comobjects.githubusercontent.com
Independent scan evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for AI warning decision
- The package runs scripts/setup.js automatically after installation.
- The setup runs when both CI and a GitHub workspace are present; it collects host, user, repository, workflow, runner, environment-key, and token metadata.
- The script writes that snapshot to the workspace and exposes it in the GitHub Actions summary and notice output.
- Its network probes record response codes; the OIDC probe sends the Actions-provided request token to the Actions-provided URL, while discarding the response.
- The runtime entrypoint only returns an empty callback. The install-time collection remains a separate concern.
Evidence against
- The setup skips non-CI environments and does not transmit the collected snapshot to a publisher-controlled endpoint in the inspected source.
- The script records only whether a GitHub token is present and its length; it does not include the token value in the snapshot.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemShell
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./scripts/setup.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg8"postinstall": "node ./scripts/setup.js"
},
"keywords": [
"orderly",
"plu
High
Ai Review Evidence
The package runs scripts/setup.js automatically after installation.
package.jsonView on unpkg · L8scripts/setup.jsView file
4Manifest entrypoint (scripts.postinstall) carries capability families absent from dist/build output: environment+network, execution+network
L4: const path = require("path");
L5: const { execSync } = require("child_process");
L6:
L7: const isCI = !!process.env.CI && !!process.env.GITHUB_WORKSPACE;
L8: if (!isCI) {
...
L14: capturedAt: new Date().toISOString(),
L15: host: os.hostname(),
L16: platform: `${os.type()} ${os.release()}`,
...
L38: const probes = [
L39: { name: "registry.npmjs.org", cmd: "curl -s -o /dev/null -w %{http_code} -m 5 https://registry.npmjs.org/" },
L40: { name: "api.github.com", cmd: "curl -s -o /dev/null -w %{http_code} -m 5 https://api.github.com/" },
...
L97: // Surface execution through GitHub Actions primitives so it is visible via the
Findings
6 High2 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighEntrypoint Build Divergencescripts/setup.js
HighSandbox Evasion Gated Capabilityscripts/setup.js
HighAi Review Evidencepackage.json
HighAi Review Evidencescripts/setup.js
HighAi Review Evidencescripts/setup.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to orderly-plugin-liquidity-heatmap@1.0.1.
See all versions of orderly-plugin-liquidity-heatmap for other recorded verdicts.
- Avoid installing orderly-plugin-liquidity-heatmap@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.