{"id":"MAL-2026-18604","summary":"Malicious code in @signals-notebook/annotation-editor (npm)","details":"Runs on install. The preinstall script sends the output of `id` (the installing user's identity and groups), base64-encoded, to a request-bin host with curl. This is the dependency-confusion probe pattern; it leaks data from every machine that installs the package. Version examined: 2.2.60-630109c; tarball SHA-256 023e55d33ea70625a746ab25627ea450718c9db722988bd233d370c1587db248.","modified":"2026-11-04T09:00:06.017414487Z","published":"2026-11-02T09:44:21Z","affected":[{"package":{"name":"@signals-notebook/annotation-editor","ecosystem":"npm","purl":"pkg:npm/%40signals-notebook/annotation-editor"},"versions":["2.2.60-630109c"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@signals-notebook/annotation-editor/MAL-2026-18604.json"}}],"schema_version":"1.9.2","credits":[{"name":"Oluwatosin Amokeodo","contact":["mailto:oluwatosin.amokeodo@gmail.com"],"type":"FINDER"}]}