@conduitops/logview-archive@1.0.1

Analysis

@conduitops/logview-archive@1.0.1 ships a postinstall hook (`node install.js`) that fetches and installs a second-stage package from an attacker-controlled npm registry. The registry address is not readable in the tarball: lib/toolchain.json stores it as an XOR+base64 blob and lib/origin.js decodes it at install time using the hardcoded key `c0ndu1t-ops`, yielding hxxp://139[.]196[.]94[.]195:8080/dl/npm/ — a plaintext HTTP registry on a raw IP. install.js then spawns npm to install the pinned package `@conduit/logview-cli@2.2.0` from that registry into a `vendor/` directory inside the package (`--prefix vendor --no-save --no-package-lock --no-audit --registry <decoded origin>`), which causes the remote package and its own lifecycle scripts to execute on the installer's machine. The masking is deliberate: the decoder's own comment states the intent is that a downloaded copy "carries no readable address, which defeats the string scan such a package receives." The package presents itself as an internal corporate artifact (repository ssh://[account]/platform/logview-archive.git, homepage and issue tracker on *.conduit.internal, license UNLICENSED) while being published to the public registry, so a project resolving the name installs code from the external registry instead. No credential or token harvesting was observed; the payload is remote package fetch-and-execute at install time. IOCs: registry/C2 hxxp://139[.]196[.]94[.]195:8080/dl/npm/ ; second-stage package @conduit/logview-cli@2.2.0 ; files install.js, lib/toolchain.json, lib/origin.js.