MAL-2026-18318

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@greenlake/mfe-login-url/MAL-2026-18318.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-18318

Published

2026-10-23T21:33:58Z

Modified

2026-10-26T06:00:04Z

Summary

Malicious code in @greenlake/mfe-login-url (npm)

Details

@greenlake/mfe-login-url is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version (2.0.0, 1.0.0, 3.0.0) has a postinstall script that runs node beacon.cjs on npm install, and index.js calls the same code when the package is imported; it POSTs the hostname, install path and current working directory over plain HTTP to http://185.158.107.175:8787/_ah/dc, and index.js exports a Proxy that returns no-op functions so builds importing the real package keep running. The npm account wiseke published 14 such packages under the @greenlake, @sxm-web, @drone-js-ext and @ppa-web-components scopes between 2026-10-23 21:23 and 2026-10-25 14:28 UTC; index.js is byte-identical to that of ph-common (MAL-2026-1809), which sends to the same endpoint.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8669a0a99995d7a57a13210e4b7e8fe8449f746ab808271370776d072491b3db)

@greenlake/mfe-login-url 2.0.0 presents itself as an empty compatibility shim but ships a beacon.cjs that POSTs installer hostname, install path, cwd, and Node version to the hardcoded plain-HTTP bare-IP endpoint http://185.158.107.175:8787/_ah/dc. The beacon fires in two places: package.json declares a postinstall script running node beacon.cjs, and index.js (a Proxy-based no-op stub designed not to break bundlers) invokes require('./beacon.cjs').fire() on import. The scope @greenlake and the stub-plus-beacon shape are consistent with a dependency-confusion reconnaissance package that silently confirms successful installs inside internal build systems and discloses host identifiers to an unknown operator. There is no legitimate functional code; the entire package exists to exfiltrate installer host metadata.

Database specific

{
    "iocs":  {
        "files":  [
            {
                "digests":  {
                    "sha256":  "a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d"
                },
                "note":  "Main entry point; calls beacon.cjs fire() on import and exports a no-op Proxy. Identical in all listed versions and in ph-common (MAL-2026-1809).",
                "paths":  [
                    "index.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "7702040cc46bba7b68455d8c28dcde546da84b9865e43dbf3aa2133c857c080b"
                },
                "note":  "postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (@greenlake/mfe-login-url@2.0.0).",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "0525465b55c4b5b7f12cc5c4e5321e8f21114ec96533c95ebb52edcfacfcb2b5"
                },
                "note":  "Executed by the postinstall script of @greenlake/mfe-login-url@2.0.0.",
                "paths":  [
                    "beacon.cjs"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "c72406caf8b83ef90067918b0a58d012474cd9ed7fb8bdb9e0762ac0667a34b3"
                },
                "note":  "postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (@greenlake/mfe-login-url@1.0.0).",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "0525465b55c4b5b7f12cc5c4e5321e8f21114ec96533c95ebb52edcfacfcb2b5"
                },
                "note":  "Executed by the postinstall script of @greenlake/mfe-login-url@1.0.0.",
                "paths":  [
                    "beacon.cjs"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "e25158aa482b59089ec46adb1f317bc617c59cfaf2e88e8d97fd8a1cc30a5d8d"
                },
                "note":  "postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (@greenlake/mfe-login-url@3.0.0).",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "0525465b55c4b5b7f12cc5c4e5321e8f21114ec96533c95ebb52edcfacfcb2b5"
                },
                "note":  "Executed by the postinstall script of @greenlake/mfe-login-url@3.0.0.",
                "paths":  [
                    "beacon.cjs"
                ],
                "source":  "PACKAGE_ARCHIVE"
            }
        ],
        "ips":  [
            "185.158.107.175"
        ],
        "urls":  [
            "http://185.158.107.175:8787/_ah/dc"
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-021721",
            "import_time":  "2026-10-26T05:46:52.56364945Z",
            "modified_time":  "2026-10-26T05:31:37Z",
            "sha256":  "8669a0a99995d7a57a13210e4b7e8fe8449f746ab808271370776d072491b3db",
            "source":  "amazon-inspector",
            "versions":  [
                "2.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-021722",
            "import_time":  "2026-10-26T05:46:52.611659034Z",
            "modified_time":  "2026-10-26T05:31:45Z",
            "sha256":  "95dde66d8e8b22aa7f25b7b90892ce84c3aabd70281b1680ba729d2f36dfae4a",
            "source":  "amazon-inspector",
            "versions":  [
                "3.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-021723",
            "import_time":  "2026-10-26T05:46:52.805874028Z",
            "modified_time":  "2026-10-26T05:31:52Z",
            "sha256":  "0a74b73854861db522d08bb6bce10b79172677ee3f17c8277dfd995dfef38c0a",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com
- InvisiRisk, Inc. - FINDER
- - https://www.invisirisk.com
  - mailto:research@invisirisk.com

Affected packages

npm / @greenlake/mfe-login-url

Package

Name: @greenlake/mfe-login-url; View open source insights on deps.dev
Purl: pkg:npm/%40greenlake/mfe-login-url

Affected ranges

Affected versions

1.*

1.0.0

2.*

2.0.0

3.*

3.0.0

Database specific

cwes

[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]

indicators

{
    "evidence_files":  [
        {
            "path":  "beacon.cjs",
            "sha256":  "0525465b55c4b5b7f12cc5c4e5321e8f21114ec96533c95ebb52edcfacfcb2b5",
            "tlsh":  "c33161eba8e4e0089ae77498c54f0409b17af0068501af54f95c82959f6153c33fa8dc"
        },
        {
            "path":  "index.js",
            "sha256":  "a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d",
            "tlsh":  "2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "mfe-login-url-2.0.0.tgz",
            "hashes":  {
                "sha1":  "f043c70580dade0bc10d1650ef7ead559d98d118",
                "sha512_sri":  "sha512-QshHsIwF3iUI0KYjpzY4Jqg5DdkinwBcESvo/Xi81utYdQ58SZeCB0zEoH4f0A02S3YTWizFKXDU1uLxRbGHYA=="
            }
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@greenlake/mfe-login-url/MAL-2026-18318.json"