{"items":[{"id":"NVI-00008477","kind":"supply_chain_event","title":"Malicious code in @conduitops/logview-archive (npm)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-qxg9-x88v-w2gv"],"plain_summary":"GitHub lists this malware advisory for @conduitops/logview-archive. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-41aaeb634cc921cc7cf3e055bf3c5d54"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-41aaeb634cc921cc7cf3e055bf3c5d54","url":"https://github.com/advisories/GHSA-qxg9-x88v-w2gv","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-qxg9-x88v-w2gv","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:57:08.488Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-41aaeb634cc921cc7cf3e055bf3c5d54"],"technology":"@conduitops/logview-archive","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (f20036e315be6c5dd925bdedc87120af27adb007a4c2b6653c95cb386acd9009)\nOn install, package.json's postinstall hook runs install.js, which invokes `npm install @conduit/logview-cli@2.2.0 --registry ` where the registry URL is stored as a base64+XOR-masked string in lib/toolchain.json and decoded in memory by lib/origin.js (XOR key `c0ndu1t-ops`). The decoded destination is a plain-HTTP bare IP (http://139.196.94.195:8080/dl/npm/), not the public npm registry, a known publisher host, or an internal-DNS name consistent with the package's self-claimed `conduit.internal` provenance. npm will fetch and execute the lifecycle scripts of whatever package the attacker serves at that endpoint, giving arbitrary install-time code execution on the installer's host. A comment in lib/origin.js states the masking is intended so the downloaded package `carries no readable address`, confirming the concealment is deliberate rather than incidental.\n\n---\n\nCredit: OpenSSF ([source](https://github.com/ossf/malicious-packages/blob/f17c406fb7ee5243da902499814340765fd9b86a/osv/malicious/npm/@conduitops/logview-archive/MAL-2026-18183.j","public_affected_ranges":["= 1.0.1"]}],"null_published_at":"2026-10-31T22:13:22.848Z","source_updated_at":"2026-10-22T09:31:46.000Z","source_disclosed_at":"2026-10-22T09:31:46.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:57:08.488Z"}],"next_cursor":null,"snapshot_revision":"42594"}