CERT24MAL-2026-18318 — Malicious code in @greenlake/mfe-login-url (npm)Loading data…
CERT24Threat Observatory
Period

MAL-2026-18318 — Malicious code in @greenlake/mfe-login-url (npm)

@greenlake/mfe-login-url is a dependency-confusion package described as a “Compatibility shim”; its README calls it an “authorized dependency-confusion test”. Versions 2.0.0, 1.0.0 and 3.0.0 run postinstall code during npm install and the same beacon code when the package is imported. It sends the hostname, install path and current working directory over plain HTTP to http://185.158.107.175:8787/_ah/dc; version 2.0.0 also sends the Node version.

← Back to intelligence

MAL-2026-18318 — Malicious code in @greenlake/mfe-login-url (npm)

@greenlake/mfe-login-url is a dependency-confusion package described as a “Compatibility shim”; its README calls it an “authorized dependency-confusion test”. Versions 2.0.0, 1.0.0 and 3.0.0 run postinstall code during npm install and the same beacon code when the package is imported. It sends the hostname, install path and current working directory over plain HTTP to http://185.158.107.175:8787/_ah/dc; version 2.0.0 also sends the Node version.