{"id":"MAL-2026-10763","summary":"Malicious code in @edgecommons/streamlog-node (npm)","details":"The @edgecommons/streamlog-node package was published to the npm registry by user 'ada8877' (maintainer email k3mlol@proton.me) as part of a dependency-confusion / reconnaissance campaign. The package name uses an '@edgecommons' scope that mimics the internal/private package naming convention of a target organization, so that a misconfigured resolver installs this public lookalike instead of the intended private dependency.\n\nThe package declares a preinstall hook (\"npm install @sentry/node && node examples/verify.js\") that executes automatically at npm install time, before any application code runs. The bundled examples/verify.js initializes the @sentry/node client against a hardcoded, attacker-controlled Sentry DSN with sendDefaultPii enabled, resolves the installing host's public egress IP address by requesting Cloudflare's /cdn-cgi/trace endpoint (using a spoofed desktop-browser User-Agent to bypass bot challenges), then deliberately triggers a runtime exception and captures it. Flushing the event beacons the collected host telemetry (public IP plus Sentry default PII such as hostname, OS username and runtime/environment metadata) to the attacker's Sentry ingest endpoint at o4510485815754752.ingest.us.sentry.io.\n\nEach impersonated namespace in the campaign beacons to a distinct Sentry project ID, letting the operator attribute successful installs to specific victim organizations — behaviour consistent with a dependency-confusion reconnaissance beacon rather than legitimate error monitoring. The install-time payload is byte-for-byte identical to the earlier 'click2ai' campaign, sharing the same Sentry organization (o4510485815754752) and a related ProtonMail maintainer identity, and differs only in the package name and target DSN. This package's beacon targets Sentry project 4511632673275909.","aliases":["GHSA-4rqf-6883-f59f"],"modified":"2026-07-23T07:50:11.932311616Z","published":"2026-07-16T00:00:00Z","database_specific":{"malicious-packages-origins":null},"references":[{"type":"WEB","url":"https://www.npmjs.com/package/@edgecommons/streamlog-node"}],"affected":[{"package":{"name":"@edgecommons/streamlog-node","ecosystem":"npm","purl":"pkg:npm/%40edgecommons/streamlog-node"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"iocs":{"urls":["https://30ac1f6d2b8675e25a1314b7829c30c2@o4510485815754752.ingest.us.sentry.io/4511632673275909"],"domains":["o4510485815754752.ingest.us.sentry.io"]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@edgecommons/streamlog-node/MAL-2026-10763.json"}}],"schema_version":"1.7.5","credits":[{"name":"SafeDep","contact":["https://safedep.io"],"type":"FINDER"}]}