MAL-2026-18183

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@conduitops/logview-archive/MAL-2026-18183.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18183
Published
2026-10-22T06:10:48Z
Modified
2026-10-22T06:45:04Z
Summary
Malicious code in @conduitops/logview-archive (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f20036e315be6c5dd925bdedc87120af27adb007a4c2b6653c95cb386acd9009)

On install, package.json's postinstall hook runs install.js, which invokes npm install @conduit/logview-cli@2.2.0 --registry <URL> where the registry URL is stored as a base64+XOR-masked string in lib/toolchain.json and decoded in memory by lib/origin.js (XOR key c0ndu1t-ops). The decoded destination is a plain-HTTP bare IP (http://139.196.94.195:8080/dl/npm/), not the public npm registry, a known publisher host, or an internal-DNS name consistent with the package's self-claimed conduit.internal provenance. npm will fetch and execute the lifecycle scripts of whatever package the attacker serves at that endpoint, giving arbitrary install-time code execution on the installer's host. A comment in lib/origin.js states the masking is intended so the downloaded package carries no readable address, confirming the concealment is deliberate rather than incidental.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-021570",
            "import_time":  "2026-10-22T06:30:24.038889636Z",
            "modified_time":  "2026-10-22T06:10:48Z",
            "sha256":  "f20036e315be6c5dd925bdedc87120af27adb007a4c2b6653c95cb386acd9009",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @conduitops/logview-archive

Package

Name
@conduitops/logview-archive
View open source insights on deps.dev
Purl
pkg:npm/%40conduitops/logview-archive

Affected ranges

Affected versions

1.*
1.0.1

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "install.js",
            "sha256":  "0d11efbb0880f2b9f3d4c8f073cf4ddddb105badc34ffaed48ae76d59a0609a8",
            "tlsh":  "2891658b55e592361ed345ba764f80067207d06a1258ee54f0cdc3f5bf1913ccab39da"
        },
        {
            "path":  "lib/origin.js",
            "sha256":  "4a2485296ad2178b7bf07ebba6d13b300728582dd9ca673aa3e262d46e49c44e",
            "tlsh":  "bc31319b2fb553258282456e13cda9c3b7aa92793439c5c5a4e503a84f044f802b3df8"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "logview-archive-1.0.1.tgz",
            "hashes":  {
                "sha1":  "0b49478bb2f4e40d6e34adee09daa9c8f8c73fc8",
                "sha512_sri":  "sha512-WVaGiqCSOkepoyxB63XRBXFFyhA3Y1sfHw9ijcHgc4v6c6sCei+3FwNsQRCZfhrwwjT211rz/W3j4IoHy2mG4A=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@conduitops/logview-archive/MAL-2026-18183.json"