MAL-2026-18317

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@greenlake/context-pane/MAL-2026-18317.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18317
Published
2026-10-23T21:33:13Z
Modified
2026-10-26T06:00:04Z
Summary
Malicious code in @greenlake/context-pane (npm)
Details

@greenlake/context-pane is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version (3.0.0, 1.0.0) has a postinstall script that runs node beacon.cjs on npm install, and index.js calls the same code when the package is imported; it POSTs the hostname, install path and current working directory over plain HTTP to http://185.158.107.175:8787/_ah/dc, and index.js exports a Proxy that returns no-op functions so builds importing the real package keep running. The npm account wiseke published 14 such packages under the @greenlake, @sxm-web, @drone-js-ext and @ppa-web-components scopes between 2026-10-23 21:23 and 2026-10-25 14:28 UTC; index.js is byte-identical to that of ph-common (MAL-2026-1809), which sends to the same endpoint.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b7f6299b80d36c1d11d7a258c9bffdeb2e1281348e599487c011dd9e959d7120)

The package declares a postinstall script (beacon.cjs) and a main entry (index.js) that both invoke a beacon POSTing the installer's hostname, install path, cwd, and node version to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over cleartext HTTP. The destination is a bare IPv4 on a non-standard port, unrelated to any publisher infrastructure. The package has no advertised functionality: main exports a Proxy of no-op functions so that bundlers and consumers do not crash on property access, while the require-time path and the postinstall hook both exist solely to trigger the callback. The package self-describes as a 'Compatibility shim' with no legitimate reason to phone home, and the generic @greenlake/context-pane name combined with the no-op export surface is consistent with a dependency-confusion lure whose only effect on installers is the install-time and import-time beacon.

Database specific 
{
    "iocs":  {
        "files":  [
            {
                "digests":  {
                    "sha256":  "a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d"
                },
                "note":  "Main entry point; calls beacon.cjs fire() on import and exports a no-op Proxy. Identical in all listed versions and in ph-common (MAL-2026-1809).",
                "paths":  [
                    "index.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "8690c53e68016b3e0b569ed4bc1150c8e81e39ebffb671d7b48e49241e448d8c"
                },
                "note":  "postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (@greenlake/context-pane@3.0.0).",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "9569f202fb4895dc6e2b4caa4816a83e38ec98b21e9f033dc645108ad09620a4"
                },
                "note":  "Executed by the postinstall script of @greenlake/context-pane@3.0.0.",
                "paths":  [
                    "beacon.cjs"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "cf3f638396ae81789ebb2c861160ef5b4a72e0ee2e8f235658ead13eca65aba5"
                },
                "note":  "postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (@greenlake/context-pane@1.0.0).",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "9569f202fb4895dc6e2b4caa4816a83e38ec98b21e9f033dc645108ad09620a4"
                },
                "note":  "Executed by the postinstall script of @greenlake/context-pane@1.0.0.",
                "paths":  [
                    "beacon.cjs"
                ],
                "source":  "PACKAGE_ARCHIVE"
            }
        ],
        "ips":  [
            "185.158.107.175"
        ],
        "urls":  [
            "http://185.158.107.175:8787/_ah/dc"
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-021720",
            "import_time":  "2026-10-26T05:46:52.427021382Z",
            "modified_time":  "2026-10-26T05:31:29Z",
            "sha256":  "2e7fe98e5ed7053b6c39135e5f3adfe42ceea11edfcc5eb5d61e421c23b37b55",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-021719",
            "import_time":  "2026-10-26T05:46:52.312949431Z",
            "modified_time":  "2026-10-26T05:31:07Z",
            "sha256":  "b7f6299b80d36c1d11d7a258c9bffdeb2e1281348e599487c011dd9e959d7120",
            "source":  "amazon-inspector",
            "versions":  [
                "3.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @greenlake/context-pane

Package

Name
@greenlake/context-pane
View open source insights on deps.dev
Purl
pkg:npm/%40greenlake/context-pane

Affected ranges

Affected versions

1.*
1.0.0
3.*
3.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "beacon.cjs",
            "sha256":  "9569f202fb4895dc6e2b4caa4816a83e38ec98b21e9f033dc645108ad09620a4",
            "tlsh":  "ac3161eba8f1a048aaaa7098c54f0409b27af0068501ab50f95c83959fa157c33fa8dc"
        },
        {
            "path":  "index.js",
            "sha256":  "a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d",
            "tlsh":  "2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "context-pane-1.0.0.tgz",
            "hashes":  {
                "sha1":  "7b005b61b81864d7e5f877d49849c290b19f7e1f",
                "sha512_sri":  "sha512-lw83qrRDz/rH9BDE4e6bF1IpS7zMVM/QsZwxA+VW966ZE5+wyDwoVBmIr4aJBlAjmJgzFP3LhWS5mp5J0mcn0g=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@greenlake/context-pane/MAL-2026-18317.json"