npm · Malicious package advisory
Malware@signals-notebook/annotation-editor
MAL-2026-18604
Malicious code in @signals-notebook/annotation-editor (npm)
Details
Runs on install. The preinstall script sends the output of `id` (the installing user's identity and groups), base64-encoded, to a request-bin host with curl. This is the dependency-confusion probe pattern; it leaks data from every machine that installs the package. Version examined: 2.2.60-630109c; tarball SHA-256 023e55d33ea70625a746ab25627ea450718c9db722988bd233d370c1587db248.
Compromised versions (1)
- 2.2.60-630109c
Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.