npm: four malicious packages (@conduitops/logview-archive, formatting-subtitles, simplewave, log-rotate-testmetest) execute attacker-controlled code at install time (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-22
GitHub Advisory Database published four npm malware advisories on 2026-10-22, each critical with no patched versions. @conduitops/logview-archive uses a postinstall hook to fetch and run a package from an attacker-controlled plain-HTTP bare-IP registry (139.196.94.195:8080) hidden behind base64+XOR masking. formatting-subtitles hides shell commands inside a fake JS comment in prepare.js, beaconing to webhook.site and executing unpinned content from a mutable GitHub Gist. simplewave exfiltrates os.hostname() to an oast.fun Interactsh collector on install. log-rotate-testmetest abuses binding.gyp command expansion to run a ROT+AES-GCM+brotli-obfuscated payload under Bun. Any developer or CI machine installing these versions gets arbitrary code execution or data exfiltration; no vendor fix exists since the packages are malware.
What to do
- Search dependency locks, CI logs and caches for the four package/version pairs and remove them from all manifests and lockfiles
- Treat any machine or CI runner that installed them as compromised: rotate credentials, tokens and keys accessible to those environments and rebuild from clean images
- Block egress to 139.196.94.195:8080, webhook.site/9e8c8742-3102-4716-aa8b-e150e9e84fe7, api.github.com/gists/da04f14c93acbe9a7aef827be0a2e91c and oast.fun in build environments
- Disable or restrict npm lifecycle scripts (e.g. npm config set ignore-scripts true, --ignore-scripts in CI) and audit any package requiring install scripts
- Prefer pinned, provenance-verified dependencies from internal registries/proxies and scan for typosquat package names
Sources
All live incidents on Threat Watch
