{"id":"MAL-2026-18318","summary":"Malicious code in @greenlake/mfe-login-url (npm)","details":"@greenlake/mfe-login-url is a dependency-confusion package: it is described as a \"Compatibility shim\", uses inflated version numbers, and its README calls it an \"authorized dependency-confusion test\". Each listed version (2.0.0, 1.0.0, 3.0.0) has a postinstall script that runs `node beacon.cjs` on npm install, and index.js calls the same code when the package is imported; it POSTs the hostname, install path and current working directory over plain HTTP to `http://185.158.107.175:8787/_ah/dc`, and index.js exports a Proxy that returns no-op functions so builds importing the real package keep running. The npm account wiseke published 14 such packages under the @greenlake, @sxm-web, @drone-js-ext and @ppa-web-components scopes between 2026-10-23 21:23 and 2026-10-25 14:28 UTC; index.js is byte-identical to that of ph-common (MAL-2026-1809), which sends to the same endpoint.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8669a0a99995d7a57a13210e4b7e8fe8449f746ab808271370776d072491b3db)\n@greenlake/mfe-login-url 2.0.0 presents itself as an empty compatibility shim but ships a beacon.cjs that POSTs installer hostname, install path, cwd, and Node version to the hardcoded plain-HTTP bare-IP endpoint http://185.158.107.175:8787/_ah/dc. The beacon fires in two places: package.json declares a postinstall script running `node beacon.cjs`, and index.js (a Proxy-based no-op stub designed not to break bundlers) invokes `require('./beacon.cjs').fire()` on import. The scope `@greenlake` and the stub-plus-beacon shape are consistent with a dependency-confusion reconnaissance package that silently confirms successful installs inside internal build systems and discloses host identifiers to an unknown operator. There is no legitimate functional code; the entire package exists to exfiltrate installer host metadata.\n","modified":"2026-10-26T06:00:04.208569959Z","published":"2026-10-23T21:33:58Z","database_specific":{"malicious-packages-origins":[{"sha256":"8669a0a99995d7a57a13210e4b7e8fe8449f746ab808271370776d072491b3db","source":"amazon-inspector","versions":["2.0.0"],"id":"IN-MAL-2026-021721","import_time":"2026-10-26T05:46:52.56364945Z","modified_time":"2026-10-26T05:31:37Z"},{"sha256":"95dde66d8e8b22aa7f25b7b90892ce84c3aabd70281b1680ba729d2f36dfae4a","source":"amazon-inspector","versions":["3.0.0"],"id":"IN-MAL-2026-021722","import_time":"2026-10-26T05:46:52.611659034Z","modified_time":"2026-10-26T05:31:45Z"},{"source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-021723","import_time":"2026-10-26T05:46:52.805874028Z","modified_time":"2026-10-26T05:31:52Z","sha256":"0a74b73854861db522d08bb6bce10b79172677ee3f17c8277dfd995dfef38c0a"}],"iocs":{"urls":["http://185.158.107.175:8787/_ah/dc"],"files":[{"note":"Main entry point; calls beacon.cjs fire() on import and exports a no-op Proxy. Identical in all listed versions and in ph-common (MAL-2026-1809).","paths":["index.js"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d"}},{"digests":{"sha256":"7702040cc46bba7b68455d8c28dcde546da84b9865e43dbf3aa2133c857c080b"},"note":"postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (@greenlake/mfe-login-url@2.0.0).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"note":"Executed by the postinstall script of @greenlake/mfe-login-url@2.0.0.","paths":["beacon.cjs"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"0525465b55c4b5b7f12cc5c4e5321e8f21114ec96533c95ebb52edcfacfcb2b5"}},{"digests":{"sha256":"c72406caf8b83ef90067918b0a58d012474cd9ed7fb8bdb9e0762ac0667a34b3"},"note":"postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (@greenlake/mfe-login-url@1.0.0).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"paths":["beacon.cjs"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"0525465b55c4b5b7f12cc5c4e5321e8f21114ec96533c95ebb52edcfacfcb2b5"},"note":"Executed by the postinstall script of @greenlake/mfe-login-url@1.0.0."},{"source":"PACKAGE_ARCHIVE","digests":{"sha256":"e25158aa482b59089ec46adb1f317bc617c59cfaf2e88e8d97fd8a1cc30a5d8d"},"note":"postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (@greenlake/mfe-login-url@3.0.0).","paths":["package.json"]},{"paths":["beacon.cjs"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"0525465b55c4b5b7f12cc5c4e5321e8f21114ec96533c95ebb52edcfacfcb2b5"},"note":"Executed by the postinstall script of @greenlake/mfe-login-url@3.0.0."}],"ips":["185.158.107.175"]}},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@greenlake/mfe-login-url"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@greenlake/mfe-login-url/v/2.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@greenlake/mfe-login-url/v/3.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@greenlake/mfe-login-url/v/1.0.0"}],"affected":[{"package":{"name":"@greenlake/mfe-login-url","ecosystem":"npm","purl":"pkg:npm/%40greenlake/mfe-login-url"},"versions":["2.0.0","1.0.0","3.0.0"],"database_specific":{"indicators":{"evidence_files":[{"path":"beacon.cjs","sha256":"0525465b55c4b5b7f12cc5c4e5321e8f21114ec96533c95ebb52edcfacfcb2b5","tlsh":"c33161eba8e4e0089ae77498c54f0409b17af0068501af54f95c82959f6153c33fa8dc"},{"path":"index.js","sha256":"a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d","tlsh":"2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee"}],"package_integrity":[{"hashes":{"sha1":"f043c70580dade0bc10d1650ef7ead559d98d118","sha512_sri":"sha512-QshHsIwF3iUI0KYjpzY4Jqg5DdkinwBcESvo/Xi81utYdQ58SZeCB0zEoH4f0A02S3YTWizFKXDU1uLxRbGHYA=="},"filename":"mfe-login-url-2.0.0.tgz"}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@greenlake/mfe-login-url/MAL-2026-18318.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}