Dependency-confusion beacon package identity-two-factor targets Coinbase on npm
Severity: critical · Patch status: no-fix-needed · Since 2026-10-29
OpenSSF reported a dependency-confusion package, identity-two-factor@999.0.0 on npm, explicitly aimed at Coinbase (README and postinstall.js reference it; beacon path 'cbhq-canary'). The package has no functional code; its postinstall script runs node postinstall.js on npm install, writes a marker file to the temp directory, and POSTs hostname, username, working-directory name, CI flag and Node version to a webhook.site endpoint. It was published by the npm account hologrammmm0x, which has no other packages. Any developer or CI environment that installs the package leaks host details to the attacker. GitHub advisory GHSA-2hrq-h3vj-5wxm (CWE-506, critical) lists affected version 999.0.0 with no patched versions; the package should be removed/uninstalled, not upgraded.
What to do
- Search dependency locks, caches and install logs for identity-two-factor@999.0.0 and remove it; treat any machine or CI runner that installed it as potentially probed
- Check temp directories for the marker file and review egress/proxy logs for requests to webhook.site/e0981a8e-081e-49a0-8b4a-235109e13045/cbhq-canary
- Block the webhook.site endpoint and audit internal package names for dependency-confusion exposure; reserve internal names on public registries
- Enforce npm install scripts restrictions (e.g. --ignore-scripts, allowlists) and pin trusted registry sources in CI
Sources
All live incidents on Threat Watch
