MAL-2026-17848 — Malicious code in orderly-plugin-liquidity-heatmap (npm)

orderly-plugin-liquidity-heatmap presents itself as a liquidity heatmap plugin for the Orderly Network orderbook widget, but its only export is an empty stub. A postinstall script collects information from GitHub Actions environments and, from version 1.0.2, uses the workflow’s GITHUB_TOKEN to write a report to the installing repository’s default branch. Versions 1.0.4 and 1.0.6 can also force-push a Git tag using credentials persisted in .git/config.