CERT24MAL-2026-18282 — Malicious code in @greenlake/common-context (npm)Loading data…
CERT24Threat Observatory
Period

MAL-2026-18282 — Malicious code in @greenlake/common-context (npm)

@greenlake/common-context is a dependency-confusion package described as a compatibility shim. Versions 99.0.1 and 3.0.0 run a postinstall script during npm install and the same beacon code when the package is imported. The code sends the hostname, installation path, current working directory and Node version over plaintext HTTP to http://185.158.107.175:8787/_ah/dc.

← Back to intelligence

MAL-2026-18282 — Malicious code in @greenlake/common-context (npm)

@greenlake/common-context is a dependency-confusion package described as a compatibility shim. Versions 99.0.1 and 3.0.0 run a postinstall script during npm install and the same beacon code when the package is imported. The code sends the hostname, installation path, current working directory and Node version over plaintext HTTP to http://185.158.107.175:8787/_ah/dc.