The malicious npm package @mrbenty8jf1p9y5/oidc-bind-canary version 0.0.3 includes a postinstall lifecycle script that issues an HTTPS request from the installer's machine to a Cloudflare tunnel at wiki-shared-carlos-exempt.trycloudflare.com on the path /token-capture. The request spoofs the Host header as dependabot-api.githubapp.com and disables TLS certificate validation (rejectUnauthorized:false), disguising the callout as legitimate GitHub Dependabot traffic. This indicates an automatic beacon to an attacker-controlled listener firing during package installation, potentially enabling attacker reconnaissance or further compromise.

This malicious behavior can lead to unauthorized data exfiltration or attacker reconnaissance from the installer's environment during package installation. The spoofing and TLS validation bypass may evade detection by security tools expecting legitimate Dependabot traffic. Although no active exploits in the wild are reported, the automatic beaconing poses a risk of information leakage or further malicious actions triggered by the attacker.

No official patch or remediation is currently documented for this package version. Users should avoid installing @mrbenty8jf1p9y5/oidc-bind-canary version 0.0.3 and remove it if already installed. Monitor for updates from the package maintainer or npm advisories for any official fixes. Employ supply chain security measures such as verifying package provenance and using trusted package sources.