Malicious code in @greenlake/common-context (npm)

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (5c391fc0f0acc51479adc96cdca5e63497f47dd4304eb0a871819bce9313551e) @greenlake/[email protected] is a stub package whose main entry exports a Proxy of no-op functions and whose only real behavior is a beacon. Both scripts.postinstall (node beacon.cjs) and require() of the main entry (index.js) POST host identifiers — package name, os.hostname(), __dirname install path, process.cwd(), and node version — to the hardcoded bare-IP plaintext endpoint http://185.158.107.175:8787/_ah/dc. The destination is not registry or publisher infrastructure. Combined with the @greenlake scope, implausibly high 99.0.1 version, generic 'Compatibility shim' description, and no-op Proxy main, the package matches the canonical dependency-confusion payload shape: a lure designed to be auto-resolved in place of an internal private name and to callback-report successful installations inside the target environment.

Source published

25 Oct 2026 15:08:43 UTC

Source modified

25 Oct 2026 15:30:04 UTC

Observed here

25 Oct 2026 16:17:16 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.