@mohamed_nowisar/token3-check

{"modified":"2026-08-18T23:06:02Z","published":"2026-08-18T23:06:02Z","schema_version":"1.7.4","id":"MAL-2026-14135","summary":"Malicious code in @mohamed_nowisar/token3-check (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (10d463b1de43a90878da858dd595dadf43fcbbbb9d2e26cfd8b14ff6e0167457)\nThe package registers preinstall, install, and postinstall lifecycle hooks that all execute beacon.js. On any npm install, beacon.js collects the installer's hostname (os.hostname()), username (os.userInfo().username), current working directory (process.cwd()), platform/arch, Node.js version, and a curated set of CI-detection environment variables (including YANDEX_CI, GITHUB_ACTIONS, GITLAB_CI, JENKINS_URL) and POSTs them via https.request to a hardcoded endpoint at https://webhook.site/3687e44a-4e97-43c4-84c9-e6c93d4b2fbc. The package self-describes as a dependency-confusion canary targeting the Yandex build pipeline, but installers do not opt in to the beacon and the destination is a third-party inspection endpoint controlled by the publisher. Internal build-system identity and CI fingerprints leaked this way enable follow-on dependency-confusion attacks against the exposed pipelines.\n","affected":[{"package":{"ecosystem":"npm","name":"@mohamed_nowisar/token3-check"},"versions":["0.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"beacon.js","sha256":"167a36231c590174e7081a5ab2820fde2f87d6a3ce9a004c447afe749dd3f049","tlsh":"463120b9c36848710af507e1b76c2407a67af0763b8679b0b13662447fcc2b9013e1ab"}],"package_integrity":[{"filename":"token3-check-0.0.1.tgz","hashes":{"sha1":"733f3d7ca81332aa2befd98f011ee1cb6a323911","sha512_sri":"sha512-EEYeYya65V6cL3wmN9MauUu+sIBofT7V4+BHJOHMoWbWUGbTnVnwJai2nqQtoAyP9NqtQ2+t7dxP8UpjDF8D5w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@mohamed_nowisar/token3-check/v/0.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018179","import_time":"2026-08-18T23:09:42.1253467Z","modified_time":"2026-08-18T23:06:02Z","sha256":"10d463b1de43a90878da858dd595dadf43fcbbbb9d2e26cfd8b14ff6e0167457","source":"amazon-inspector","versions":["0.0.1"]}]}}