{"id":"MAL-2026-18183","kind":"package","aliases":["MAL-2026-18183"],"related":[],"title":"Malicious code in @conduitops/logview-archive (npm)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f20036e315be6c5dd925bdedc87120af27adb007a4c2b6653c95cb386acd9009)\nOn install, package.json's postinstall hook runs install.js, which invokes `npm install @conduit/logview-cli@2.2.0 --registry <URL>` where the registry URL is stored as a base64+XOR-masked string in lib/toolchain.json and decoded in memory by lib/origin.js (XOR key `c0ndu1t-ops`). The decoded destination is a plain-HTTP bare IP (http://139.196.94.195:8080/dl/npm/), not the public npm registry, a known publisher host, or an internal-DNS name consistent with the package's self-claimed `conduit.internal` provenance. npm will fetch and execute the lifecycle scripts of whatever package the attacker serves at that endpoint, giving arbitrary install-time code execution on the installer's host. A comment in lib/origin.js states the masking is intended so the downloaded package `carries no readable address`, confirming the concealment is deliberate rather than incidental.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@conduitops/logview-archive","fixed":[],"affected":"= 1.0.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-22T06:10:48+00:00","first_seen_at":"2026-10-26T20:51:49+00:00","triaged_at":"2026-10-26T20:57:54+00:00","updated_at":"2026-10-26T21:05:48+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-18183':8A,11A '-2026':7A,10A '139.196.94.195':80C '2.2.0':42C '8080/dl/npm':81C 'address':152C 'amazon':26C 'amazon-inspector':25C 'arbitrari':125C 'attack':119C 'bare':78C 'base64':52C 'c0ndu1t':68C 'c0ndu1t-ops':67C 'carri':149C 'claim':104C 'code':2A,129C 'comment':137C 'conceal':155C 'conduit.internal':105C 'conduit/logview-cli':41C 'conduitops/logview-archive':4A,12A 'confirm':153C 'consist':97C 'decod':60C,71C 'deliber':157C 'destin':72C 'detail':17C 'dns':95C 'download':147C 'edit':20C 'endpoint':123C 'execut':111C,130C 'f20036e315be6c5dd925bdedc87120af27adb007a4c2b6653c95cb386acd9009':28C 'fetch':109C 'give':124C 'hook':34C 'host':90C,135C 'http':77C 'incident':160C 'inspector':27C 'instal':30C,40C,127C,133C 'install-tim':126C 'install.js':36C 'intend':144C 'intern':94C 'internal-dn':93C 'invok':38C 'ip':79C 'key':66C 'known':88C 'lib/origin.js':64C,139C 'lib/toolchain.json':58C 'lifecycl':113C 'line':23C 'mal':6A,9A 'malici':1A,13B 'mask':55C,142C 'memori':62C 'name':96C 'npm':5A,39C,85C,107C 'op':69C 'packag':14B,100C,117C,148C 'package.json':31C 'per':15C 'plain':76C 'plain-http':75C 'postinstal':33C 'proven':106C 'public':84C 'publish':89C 'rather':158C 'readabl':151C 'registri':43C,46C,86C 'run':35C 'script':114C 'self':103C 'self-claim':102C 'serv':120C 'sourc':16C,24C 'state':140C 'store':49C 'string':56C 'time':128C 'url':47C 'whatev':116C 'xor':54C,65C 'xor-mask':53C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T06:10:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18183","url":"https://osv.dev/vulnerability/MAL-2026-18183","severity":"critical","published_at":"2026-10-22T06:10:48+00:00","modified_at":"2026-10-22T06:45:04+00:00","first_seen_at":"2026-10-26T20:51:49+00:00","fetched_at":"2026-10-26T20:51:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}