MAL-2026-18316

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@greenlake/auth/MAL-2026-18316.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18316
Published
2026-10-23T21:26:30Z
Modified
2026-10-26T06:00:04Z
Summary
Malicious code in @greenlake/auth (npm)
Details

@greenlake/auth is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version (3.0.0) has a postinstall script that runs node beacon.cjs on npm install, and index.js calls the same code when the package is imported; it POSTs the hostname, install path and current working directory over plain HTTP to http://185.158.107.175:8787/_ah/dc, and index.js exports a Proxy that returns no-op functions so builds importing the real package keep running. The npm account wiseke published 14 such packages under the @greenlake, @sxm-web, @drone-js-ext and @ppa-web-components scopes between 2026-10-23 21:23 and 2026-10-25 14:28 UTC; index.js is byte-identical to that of ph-common (MAL-2026-1809), which sends to the same endpoint.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d51386d7bf7b3357a9ea920b99fa08f3c2d37532e877f33a5d8d0a78c12702b5)

The package declares postinstall: node beacon.cjs and additionally fires the same beacon from index.js on require(). The beacon POSTs a JSON payload containing os.hostname(), __dirname (install path), process.cwd(), and the Node version to the hardcoded plain-HTTP bare-IP endpoint http://185.158.107.175:8787/_ah/dc, which is unrelated to any @greenlake publisher infrastructure. The package otherwise ships no functional code: index.js self-describes as a 'Compatibility shim' and exports a Proxy whose get trap returns a no-op for every property access. The shape — a @scope/<name> no-op shim whose only behavior is identifying the installing host to an attacker-controlled IP on npm install — matches the dependency-confusion probe pattern, where a public package is published under an internal scope name to map which corporate installers resolve to the public registry.

Database specific 
{
    "iocs":  {
        "files":  [
            {
                "digests":  {
                    "sha256":  "a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d"
                },
                "note":  "Main entry point; calls beacon.cjs fire() on import and exports a no-op Proxy. Identical in all listed versions and in ph-common (MAL-2026-1809).",
                "paths":  [
                    "index.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "1cfa65725a73450c9a226a6f63928c8d9e8e6b0b30677ad5312343e0ada3b3ed"
                },
                "note":  "postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (@greenlake/auth@3.0.0).",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "3796811f40e211c7d53b10fa0a7da61e0d720e5365b3412ff88e75d6e4b3f0bb"
                },
                "note":  "Executed by the postinstall script of @greenlake/auth@3.0.0.",
                "paths":  [
                    "beacon.cjs"
                ],
                "source":  "PACKAGE_ARCHIVE"
            }
        ],
        "ips":  [
            "185.158.107.175"
        ],
        "urls":  [
            "http://185.158.107.175:8787/_ah/dc"
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-021717",
            "import_time":  "2026-10-26T05:46:52.048829554Z",
            "modified_time":  "2026-10-26T05:30:46Z",
            "sha256":  "d51386d7bf7b3357a9ea920b99fa08f3c2d37532e877f33a5d8d0a78c12702b5",
            "source":  "amazon-inspector",
            "versions":  [
                "3.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @greenlake/auth

Package

Name
@greenlake/auth
View open source insights on deps.dev
Purl
pkg:npm/%40greenlake/auth

Affected ranges

Affected versions

3.*
3.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "beacon.cjs",
            "sha256":  "3796811f40e211c7d53b10fa0a7da61e0d720e5365b3412ff88e75d6e4b3f0bb",
            "tlsh":  "a2314feba8e1a048aaaa7498d54f1409b27af4069501ab50f95c83959f6193c33fa8dc"
        },
        {
            "path":  "index.js",
            "sha256":  "a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d",
            "tlsh":  "2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "auth-3.0.0.tgz",
            "hashes":  {
                "sha1":  "9165cf6032d4c06a622a7923aa32a51772f66dd7",
                "sha512_sri":  "sha512-HpBfRmNo0ZJ0N3X9s2z4ERwTjodvMneFfllIEOOVpjp9nmrxUM7wa3CPIqsuvdrJAFYK07f1DtZCpZYn3YiV0Q=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@greenlake/auth/MAL-2026-18316.json"