@mrbenty8jf1p9y5/oidc-bind-canary (npm) · Malicious Code
Affects @mrbenty8jf1p9y5/oidc-bind-canarySource GCVE Database
Malicious package : remove @mrbenty8jf1p9y5/oidc-bind-canary and rotate any secrets on hosts that installed it.
Data as of 8 Aug 2026, 15:37 UTC
Malicious package
Published to npm · OSV MAL-2026-13626
What to do
Remove @mrbenty8jf1p9y5/oidc-bind-canary from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npm@mrbenty8jf1p9y5/oidc-bind-canary | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package @mrbenty8jf1p9y5/oidc-bind-canary version 0.0.3 contains malicious code that executes during installation. Its postinstall script makes an HTTPS request to an attacker-controlled Cloudflare tunnel, spoofing the Host header to appear as legitimate GitHub Dependabot traffic and disabling TLS certificate validation. This behavior indicates an install-time beacon designed to communicate with an attacker-controlled server automatically upon npm install.