{"id":"MAL-2026-17848","summary":"Malicious code in orderly-plugin-liquidity-heatmap (npm)","details":"orderly-plugin-liquidity-heatmap poses as a liquidity heatmap plugin for the Orderly Network orderbook widget, but its only export is an empty stub and a postinstall hook runs `node ./scripts/setup.js` on npm install. When the script detects GitHub Actions (CI and GITHUB_WORKSPACE set), it records the runner's host, user, repository, GITHUB_/ACTIONS_/RUNNER_ variable names, GITHUB_TOKEN presence and length and network egress, and requests an OIDC token from ACTIONS_ID_TOKEN_REQUEST_URL. From 1.0.2 it uses the workflow's GITHUB_TOKEN to commit heatmap-setup-report.json to the default branch of the installing repository, and 1.0.4 also force-pushes a `heatmap-setup-\u003ctimestamp\u003e` git tag with the credentials actions/checkout persists in .git/config; 1.0.6 ships the same setup.js as 1.0.4. The npm account dumtban published the six versions between 13:12 and 16:05 UTC on 2026-10-11, each extending the previous one's access to the CI runner.","modified":"2026-10-13T06:30:05.184099839Z","published":"2026-10-11T13:13:56Z","database_specific":{"iocs":{"files":[{"paths":["heatmap-setup-report.json"],"source":"DROPPED","note":"Runner fingerprint written to GITHUB_WORKSPACE and, from 1.0.2, committed to the repository's default branch via the GitHub contents API."},{"paths":["heatmap-exec-trace.log"],"source":"DROPPED","note":"Execution trace appended in os.tmpdir() from 1.0.3."},{"note":"postinstall hook runs scripts/setup.js, which fingerprints GitHub Actions runners and abuses GITHUB_TOKEN.","paths":["package.json"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"44cfa921b8a56d5a79a05052a4baf85e0ec3f5a2e1ee2da064d1ca61a4451f47"}},{"source":"PACKAGE_ARCHIVE","digests":{"sha256":"39124ff7c434292b11cf607575bae99402d0afd30782a4456b858a35410b2d60"},"note":"Executed by the postinstall script.","paths":["scripts/setup.js"]},{"paths":["package.json"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"85bce265963d453cd92e88d1ae17ac0906404c91578a00c766bfa1b69aef5cd3"},"note":"postinstall hook runs scripts/setup.js, which fingerprints GitHub Actions runners and abuses GITHUB_TOKEN."},{"note":"Executed by the postinstall script.","paths":["scripts/setup.js"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"ef6413b0617623a5302ec74a086de20b59bc60da939cc85a6a165630b7fbf474"}},{"note":"postinstall hook runs scripts/setup.js, which fingerprints GitHub Actions runners and abuses GITHUB_TOKEN.","paths":["package.json"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"57c5a826212d16a686e4c829fabce9193dc8375deeea07ee24481aa62a36e27e"}},{"digests":{"sha256":"b251328db56336ed92fbb0eca68b5ca1b641a9ccdc51020c9af85e475156e5c2"},"note":"Executed by the postinstall script.","paths":["scripts/setup.js"],"source":"PACKAGE_ARCHIVE"},{"paths":["package.json"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"fb77c56b715e118d311819543efbafa5b099d008585c2e23a39e1958896c5adf"},"note":"postinstall hook runs scripts/setup.js, which fingerprints GitHub Actions runners and abuses GITHUB_TOKEN."},{"source":"PACKAGE_ARCHIVE","digests":{"sha256":"b4c09dde74153448c4e2284092cd7f664ff26c066f932e2ccf4ea6786b7d6394"},"note":"Executed by the postinstall script.","paths":["scripts/setup.js"]},{"note":"postinstall hook runs scripts/setup.js, which fingerprints GitHub Actions runners and abuses GITHUB_TOKEN.","paths":["package.json"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"d65e79e4989232b754e739b8ccfd7e89bf0e67dfbd0758e0153da4d5dd13e915"}},{"paths":["scripts/setup.js"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"6084592cd6948afb3b45bbeca20f9c9e5364961cf4bb522366d15ce6db2f33eb"},"note":"Executed by the postinstall script."},{"digests":{"sha256":"06e624fe1b1554137b9dd628887246764b37cc8f87f12501324b87710ee42091"},"note":"postinstall hook runs scripts/setup.js, which fingerprints GitHub Actions runners and abuses GITHUB_TOKEN.","paths":["package.json"],"source":"PACKAGE_ARCHIVE"}]}},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/orderly-plugin-liquidity-heatmap"}],"affected":[{"package":{"name":"orderly-plugin-liquidity-heatmap","ecosystem":"npm","purl":"pkg:npm/orderly-plugin-liquidity-heatmap"},"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.6"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/orderly-plugin-liquidity-heatmap/MAL-2026-17848.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.9.0","credits":[{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com/"],"type":"FINDER"}]}