@signals-notebook/annotation-editor

{"modified":"2026-11-02T09:44:21Z","schema_version":"1.7.4","id":"MAL-2026-18604","summary":"Malicious code in @signals-notebook/annotation-editor (npm)","details":"Runs on install. The preinstall script sends the output of `id` (the installing user's identity and groups), base64-encoded, to a request-bin host with curl. This is the dependency-confusion probe pattern; it leaks data from every machine that installs the package. Version examined: 2.2.60-630109c; tarball SHA-256 023e55d33ea70625a746ab25627ea450718c9db722988bd233d370c1587db248.","affected":[{"package":{"ecosystem":"npm","name":"@signals-notebook/annotation-editor"},"versions":["2.2.60-630109c"]}],"credits":[{"name":"Oluwatosin Amokeodo","type":"FINDER","contact":["mailto:oluwatosin.amokeodo@gmail.com"]}]}