Malicious code in @mohamed_nowisar/token3-check (npm)
The npm package @mohamed_nowisar/token3-check contained malicious code in preinstall, install, and postinstall lifecycle hooks that exfiltrated system and CI environment information to a third-party webhook endpoint without user consent.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system installing @mohamed_nowisar/token3-check; exposed build-system identities and CI environment variables enable follow-on attacks.
- Ecosystems
- Attack vectors
- Affected entities
- @mohamed_nowisar/token3-checknpm package containing malicious lifecycle hooks
The npm package @mohamed_nowisar/token3-check was published with malicious lifecycle hooks (preinstall, install, postinstall) that executed a beacon.js script on every npm install. The script collected sensitive system and build-environment data including hostname, username, current working directory, platform/architecture, Node.js version, and CI-detection environment variables (YANDEX_CI, GITHUB_ACTIONS, GITLAB_CI, JENKINS_URL, and others).\n\nThis data was exfiltrated via HTTPS POST requests to a hardcoded third-party endpoint at https://webhook.site/3687e44a-4e97-43c4-84c9-e6c93d4b2fbc. The package self-described as a dependency-confusion canary targeting Yandex's build pipeline, but installers did not opt in to the beacon and the destination was controlled by the publisher, not Yandex.\n\nThe leaked build-system identities and CI fingerprints enable follow-on dependency-confusion attacks against exposed pipelines. The incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- @mohamed_nowisar/token3-check
- Domains
- webhook.site
Remediation
- Immediately uninstall @mohamed_nowisar/token3-check from all environments
- Audit npm install logs and CI/CD logs for evidence of beacon.js execution
- Rotate credentials and secrets for any CI/CD systems that may have installed this package
- Review and strengthen dependency-confusion protections in build pipelines
- Implement npm package scanning and verification in CI/CD workflows
- Monitor for follow-on dependency-confusion attacks targeting exposed build systems
Sources
- GitHub Advisory GHSA-rhf3-vx3c-57m2 · GitHub Advisory Database
Cite this entry
"Malicious code in @mohamed_nowisar/token3-check (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-mohamed-nowisar-token3-check-npm-0v8273
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in localize-translate (npm)
The npm package localize-translate contained malicious code in its postinstall lifecycle script that collected host identifiers and beaconed them to an attacker-controlled endpoint (gigww0v7.instances.poc.jchunt.top) without user consent. The reconnaissance callback fired automatically on every installation, collecting hostname, platform, architecture, Node version, package name, and timestamp.
npmCompromised packageMalicious commit - containedcritical
Malicious code in mutex-plus (npm)
The npm package mutex-plus contains hidden malicious code that enables remote code execution when a callback object with a specific jobId hash is passed to runExclusive(). The payload is encrypted at rest in lib/plusMutex.min.js and decrypted using the jobId as a key, then executed as a detached Node.js process.
npmCompromised packageMalicious commit