MalwarePublished 28 Oct 2026Updated 29 Oct 2026

identity-two-factor (npm) · Malicious Code

Affects identity-two-factorSource GCVE Database

Malicious package : remove identity-two-factor and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 18:22 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18367

What to do

Remove identity-two-factor from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmidentity-two-factor	Affected =999.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package identity-two-factor@999.0.0 is a malicious dependency-confusion package targeting Coinbase. It contains no functional code but executes a postinstall script that collects system metadata and exfiltrates it to a third-party webhook URL. This unsolicited data exfiltration occurs automatically upon installation without user authorization.

Impact

This package causes unauthorized exfiltration of sensitive environment metadata from any system that installs it. The leaked data includes hostname, user information, working directory, CI flag, and Node.js version, which could aid attackers in reconnaissance or further targeted attacks. There is no indication of code execution beyond the postinstall script or direct system compromise, but the privacy breach and potential for information leakage are significant.

Defensive guidance

Avoid installing the identity-two-factor@999.0.0 package from public npm registries. Verify package sources and use scoped or private registries to prevent dependency confusion attacks. Remove the package if already installed and audit build and deployment pipelines for unauthorized dependencies.

Summary

The identity-two-factor package at version 999.0.0 is a dependency-confusion attack payload masquerading as an internal or private package. Its postinstall.js script runs during npm install, collecting the hostname, username, current working directory basename, CI environment flag, and Node.js version. It then sends this information via an HTTP POST request to a hardcoded webhook.site URL. The package was published by an account with no other packages and is labeled as a 'security research canary' in source comments, but this is author-controlled and does not imply consent. The package's behavior constitutes unsolicited data exfiltration from any machine that installs it.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 18:22 UTC

Technical details

References

Community reviews