Dependency-confusion probe: @signals-notebook/annotation-editor npm package leaks installer identity via preinstall script
Severity: critical · Patch status: no-fix-needed · Since 2026-11-04
OpenSSF's malicious-packages database flagged version 2.2.60-630109c of the npm package @signals-notebook/annotation-editor as malware, published to the GitHub Advisory Database on 2026-11-04 (GHSA-546q-f34h-xwmx, CWE-506). The package's preinstall script runs automatically on npm install, collecting the output of id — the installing user's identity and group memberships — base64-encoding it, and exfiltrating it via curl to a request-bin host. This is a classic dependency-confusion probe pattern, meaning any developer machine, CI runner, or build environment that installs the package leaks data to the attacker. There are no patched versions; the package is malware and should be removed entirely. Anyone who installed this version should treat the installing user's identity as disclosed and audit for further compromise.
What to do
- Remove @signals-notebook/annotation-editor 2.2.60-630109c from all dependency trees and lockfiles immediately
- Audit install logs and CI history to identify machines that installed the package
- Treat the `id` output (usernames, group memberships) of affected machines as leaked to an unknown third party
- Block the request-bin exfiltration host at network egress and check proxy logs for callbacks
- Pin internal dependency-confusion protections (scoped registry, allowlists) and scan for other typosquatted or probe packages
Sources
All live incidents on Threat Watch
