MAL-2026-18282

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@greenlake/common-context/MAL-2026-18282.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18282
Published
2026-10-25T15:08:43Z
Modified
2026-10-25T15:30:04Z
Summary
Malicious code in @greenlake/common-context (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5c391fc0f0acc51479adc96cdca5e63497f47dd4304eb0a871819bce9313551e)

@greenlake/common-context@99.0.1 is a stub package whose main entry exports a Proxy of no-op functions and whose only real behavior is a beacon. Both scripts.postinstall (node beacon.cjs) and require() of the main entry (index.js) POST host identifiers — package name, os.hostname(), __dirname install path, process.cwd(), and node version — to the hardcoded bare-IP plaintext endpoint http://185.158.107.175:8787/_ah/dc. The destination is not registry or publisher infrastructure. Combined with the @greenlake scope, implausibly high 99.0.1 version, generic 'Compatibility shim' description, and no-op Proxy main, the package matches the canonical dependency-confusion payload shape: a lure designed to be auto-resolved in place of an internal private name and to callback-report successful installations inside the target environment.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-021703",
            "import_time":  "2026-10-25T15:15:15.300427356Z",
            "modified_time":  "2026-10-25T15:08:43Z",
            "sha256":  "5c391fc0f0acc51479adc96cdca5e63497f47dd4304eb0a871819bce9313551e",
            "source":  "amazon-inspector",
            "versions":  [
                "99.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @greenlake/common-context

Package

Name
@greenlake/common-context
View open source insights on deps.dev
Purl
pkg:npm/%40greenlake/common-context

Affected ranges

Affected versions

99.*
99.0.1

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "beacon.cjs",
            "sha256":  "153963a6afdfd5200c41e1b22a3679bfd7972b2f49e7aa817cb6818695c3312c",
            "tlsh":  "f63161eba8e1a008aae67098c54f1409b27af4069501af50f95c82959fa197c33fa8dc"
        },
        {
            "path":  "package.json",
            "sha256":  "b6ec62a2b3da8ec835561fd997e2e6128f3d485d53079ee7b0396629bb37b075",
            "tlsh":  "10d05e3099216e2364c86fe20d766a0b5aa20e6b02147c1837a7915c46ecb7b24ff36d"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "common-context-99.0.1.tgz",
            "hashes":  {
                "sha1":  "57616d59c16bcb508f0f565c198cec32ea0a5ddf",
                "sha512_sri":  "sha512-cc8y20sP6/yF1oZmyt1UGrqlvGeudw0cmm/FiDEGhpt0tJt0yxxEtTFdwKJxflEpH10y2saccuk3egcbSyxGQA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@greenlake/common-context/MAL-2026-18282.json"