Malicious code in @conduitops/logview-archive (npm)

The @conduitops/logview-archive npm package version 1.0.1 includes a postinstall hook in package.json that executes install.js. This script decodes a base64 and XOR-masked URL stored in lib/toolchain.json using the key 'c0ndu1t-ops' to reveal an HTTP IP address (http://139.196.94.195:8080/dl/npm/), which is not a legitimate npm registry. It then runs 'npm install @conduit/[email protected]' from this malicious registry, allowing the attacker to serve arbitrary lifecycle scripts that execute code during installation. The masking of the URL is intentional to conceal the attacker's server address, enabling arbitrary code execution on the victim's machine during package installation.

An attacker controlling the malicious registry can execute arbitrary code on any system installing the affected package version 1.0.1. This compromises the installer's environment, potentially leading to full system compromise, data theft, or further malware deployment. The attack occurs silently during the npm install process, making it difficult to detect without inspecting the package scripts.

No official patch or remediation is currently documented. Users should avoid installing @conduitops/logview-archive version 1.0.1. Verify package sources and avoid installing packages that use obfuscated or non-standard registries. Monitor for updates from the package maintainer or npm security advisories for any official fixes or removal of the malicious package.