Malicious code in @conduitops/logview-archive (npm)

{
  "id": "6dfc82fa269b47b0054bd6807398319046ba65677753bce2cd6f01b32af96b76",
  "url": "https://osv.dev/vulnerability/MAL-2026-18183",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in @conduitops/logview-archive (npm)",
    "summary": "--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f20036e315be6c5dd925bdedc87120af27adb007a4c2b6653c95cb386acd9009) On install, package.json's postinstall hook runs install.js, which invokes `npm install @conduit/logview-cli@2.2.0 --registry ` where the registry URL is stored as a base64+XOR-masked string in lib/toolchain.json and decoded in memory by lib/origin.js (XOR key `c0ndu1t-ops`). The decoded destination is a plain-HTTP bare IP (http://139.196.94.195:8080/dl/npm/), not the public npm registry, a known publisher host, or an internal-DNS name consistent with the package's self-claimed `conduit.internal` provenance. npm will fetch and execute the lifecycle scripts of whatever package the attacker serves at that endpoint, giving arbitrary install-time code execution on the installer's host. A comment in lib/origin.js states the masking is intended so the downloaded package `carries no readable address`, confirming the concealment is deliberate rather than incidental.",
    "evidence": "osv:MAL-2026-18183",
    "products": [
      {
        "name": {
          "value": "@conduitops/logview-archive",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "1.0.1",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-18183",
      "aliases": [
        "MAL-2026-18183"
      ],
      "affected": [
        {
          "package": {
            "name": "@conduitops/logview-archive",
            "purl": "pkg:npm/%40conduitops/logview-archive",
            "ecosystem": "npm"
          },
          "versions": [
            "1.0.1"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@conduitops/logview-archive/MAL-2026-18183.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "install.js",
                  "tlsh": "2891658b55e592361ed345ba764f80067207d06a1258ee54f0cdc3f5bf1913ccab39da",
                  "sha256": "0d11efbb0880f2b9f3d4c8f073cf4ddddb105badc34ffaed48ae76d59a0609a8"
                },
                {
                  "path": "lib/origin.js",
                  "tlsh": "bc31319b2fb553258282456e13cda9c3b7aa92793439c5c5a4e503a84f044f802b3df8",
                  "sha256": "4a2485296ad2178b7bf07ebba6d13b300728582dd9ca673aa3e262d46e49c44e"
                }
              ],
              "package_integrity": [
                {
                  "hashes": {
                    "sha1": "0b49478bb2f4e40d6e34adee09daa9c8f8c73fc8",
                    "sha512_sri": "sha512-WVaGiqCSOkepoyxB63XRBXFFyhA3Y1sfHw9ijcHgc4v6c6sCei+3FwNsQRCZfhrwwjT211rz/W3j4IoHy2mG4A=="
                  },
                  "filename": "logview-archive-1.0.1.tgz"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-22T06:45:04.772652670Z",
      "provider": "osv",
      "references": [
        "https://www.npmjs.com/package/@conduitops/logview-archive/v/1.0.1"
      ],
      "provider_metadata": {
        "malicious-packages-origins": [
          {
            "id": "IN-MAL-2026-021570",
            "sha256": "f20036e315be6c5dd925bdedc87120af27adb007a4c2b6653c95cb386acd9009",
            "source": "amazon-inspector",
            "versions": [
              "1.0.1"
            ],
            "import_time": "2026-10-22T06:30:24.038889636Z",
            "modified_time": "2026-10-22T06:10:48Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 404569,
  "published_at": "2026-10-22T06:10:48+00:00"
}