npm · Malicious package advisory
Malware@markscan/reports
GHSA-4cf9-hccx-p3rv
Malicious code in @markscan/reports (npm)
Details
**Severity:** Critical **Affected versions:** `> 0` The @markscan/reports package was published to the npm registry by user 'jonothhu' (maintainer email [email protected]) as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped (@scope/name) forms so that a misconfigured resolver installs the public lookalike instead of an intended private/internal dependency. Each package self-describes as an 'AUTHORIZED SECURITY RESEARCH CANARY' (static token PATHC-CANARY-2026, contact [email protected]), but ships an unconsented install-time beacon and provides no legitimate functionality. The package declares a postinstall hook ("node postinstall.js") that executes automatically on npm install. The bundled postinstall.js collects host reconnaissance - the package/canary name, the static token 'PATHC-CANARY-2026', an event label, a UTC timestamp, the Node.js version, the current working directory, the platform, and os.hostname() - and exfiltrates it via HTTPS POST to a hardcoded anonymous dead-drop at https://webhook.site/129cb2ee-ba08-4b3c-989c-270dc0030350 (the same collector across all 19 packages). Request errors are swallowed. The self-attestation of 'authorized security research' present in the package metadata is unverifiable and does not change the disposition: the package performs unconsented telemetry collection and exfiltration at install time to an anonymous collector, matching the behavior of a dependency-confusion reconnaissance beacon. Install-time behavior and the shared collector endpoint were confirmed by static analysis of a sample spanning all three namespaces and both scoped and unscoped variants. --- Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/4af45a1e6a964fd988b3192af372c51fad107846/osv/malicious/npm/@markscan/reports/MAL-2026-10953.json)) **References:** - https://github.com/ossf/malicious-packages/blob/4af45a1e6a964fd988b3192af372c51fad107846/osv/malicious/npm/@markscan/reports/MAL-2026-10953.json - https://www.npmjs.com/package/@markscan/reports - https://github.com/advisories/GHSA-4cf9-hccx-p3rv
Compromised versions (1)
- > 0
Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.