registry / Malware / @conduitops/logview-archive

@conduitops/logview-archive

Streaming authenticated encryption, key management and log-archive formats for retained logs

This report shows the evidence for @conduitops/logview-archive@1.0.1, the only known version.

AI Security Review

scanned 15h ago · by lpm-firewall-ai

The automatic postinstall fetches a separate package from an obfuscated, non-HTTPS registry, and the source explicitly describes the masking as defeating string scans. This concealed install-time remote package chain supports blocking publication.

Static reason

One or more suspicious static signals were detected.

Trigger

Installing this package with lifecycle scripts enabled runs its postinstall hook.

Impact

The install contacts the concealed registry and permits npm to process a remote package and its lifecycle behavior during installation.

Mechanism

The hook decodes a registry address and invokes npm to install @conduit/logview-cli@2.2.0 into a vendor directory.

Attack narrative

During postinstall, the package decodes an obfuscated registry address and invokes npm to install a pinned CLI package from that HTTP endpoint. The decoder source says the masking defeats string scans. This creates a concealed remote package installation chain during consumer installation.

AI rationale

Evidence

package.jsoninstall.jslib/toolchain.jsonlib/origin.js

Network endpoints1

139.196.94.195:8080/dl/npm/

Decision evidence

public snapshot

AI called this Malicious at 95.0% confidence as Malware with low false-positive risk.

Evidence for block

The package manifest runs install.js automatically during postinstall.
The hook installs a separate CLI package into a vendor directory and supplies a decoded registry address to npm.
The registry address is XOR/base64 encoded and decodes to an HTTP endpoint at 139.196.94.195:8080.
The decoder’s source explains that masking defeats string scans.

Evidence against

The install targets a package-local vendor directory and skips installation when the host already provides the CLI.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 21 file(s), 481 KB of source

Source & flagged code

6 flagged

package.jsonView file

Lines 1-33json

2 "name": "@conduitops/logview-archive",

3 "version": "1.0.1",

4 "description": "Streaming authenticated encryption, key management and log-archive formats for retained logs",

5 "license": "UNLICENSED",

6 "main": "index.js",

7 "types": "types/index.d.ts",

8 "bin": {

9 "logview-archive": "bin/logview-archive.js"

10 },

11 "scripts": {

12 "test": "node test/run.js",

13 "postinstall": "node install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L13

14 },

15 "files": [

16 "index.js",

17 "install.js",

18 "lib/",

19 "src/",

20 "bin/",

21 "types/",

22 "README.md"

23 ],

24 "engines": {

High

Suspicious Lifecycle Evidence

The package manifest runs install.js automatically during postinstall.

package.jsonView on unpkg · L13

25 "node": ">=14.16.0"

26 },

27 "keywords": [

28 "crypto",

29 "encryption",

30 "aead",

31 "keyring",

32 "vault",

33 "ndjson",

src/core/bytes.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/core/bytes.js#virtual:normalized:round1View on unpkg

install.jsView file

Lines 86-160javascript

86 }

87}

89/** The npm entry point for this install, when one is known. */

90function npmEntry() {

91 const exec = process.env.npm_execpath;

92 if (!exec) {

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

13"postinstall": "node install.js" }, "files": [ "index.js", "install.js", "lib/", "src/", "bin/", "types/", "README.md" ], "engines": { "node

High

Suspicious Lifecycle Evidence

The package manifest runs install.js automatically during postinstall.

package.jsonView on unpkg · L13

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/core/bytes.js#virtual:normalized:round1View file

Findings

5 High3 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSemantic Analysis Limitedsrc/core/bytes.js#virtual:normalized:round1

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidenceinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowNo License

Affected versions and remediation

This report applies to @conduitops/logview-archive@1.0.1.

The versions list below shows the verdict for each recorded version.

Avoid installing @conduitops/logview-archive@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-22 10:19:01.170Z (UTC).

Source advisory published: 2026-10-22 06:10:48.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

1.0.1latestshownMaliciousMalwareBlockPublishedOct 21, 2026, 3:33 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Behavioral surface

Related packages

Other malware packages

Source & flagged code