CERT24MAL-2026-18316 — Malicious code in @greenlake/auth (npm)Loading data…
CERT24Threat Observatory
Period

MAL-2026-18316 — Malicious code in @greenlake/auth (npm)

@greenlake/auth is a dependency-confusion package described as a “Compatibility shim” with inflated version numbers. Its README calls it an “authorized dependency-confusion test.” Version 3.0.0 sends system information over plain HTTP to 185.158.107.175:8787 during npm install and when the package is imported.

← Back to intelligence

MAL-2026-18316 — Malicious code in @greenlake/auth (npm)

@greenlake/auth is a dependency-confusion package described as a “Compatibility shim” with inflated version numbers. Its README calls it an “authorized dependency-confusion test.” Version 3.0.0 sends system information over plain HTTP to 185.158.107.175:8787 during npm install and when the package is imported.