Which versions of @greenlake/common-context are malicious?

The following npm versions of @greenlake/common-context are flagged malicious: 3.0.0, 99.0.1. Treat any of these as compromised.

How do I remediate @greenlake/common-context if I installed it?

@greenlake/common-context establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.

I already installed @greenlake/common-context — how do I know if it already compromised me?

If @greenlake/common-context was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is @greenlake/common-context part of a known attack campaign?

Yes — @greenlake/common-context is associated with the IN-MAL-2026-021703, IN-MAL-2026-021718 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find @greenlake/common-context across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for @greenlake/common-context (2 malicious versions).

Malicious package

@greenlake/common-contextnpm

Advisory published Oct 23, 2026Updated Oct 26, 2026

@greenlake/common-context is a confirmed malicious npm package (MAL-2026-18282) that opens a backdoor for remote access (malicious versions 3.0.0, 99.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in @greenlake/common-context (npm)

MAL-2026-18282

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall @greenlake/common-context

What this malware does

@greenlake/common-context is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version (99.0.1, 3.0.0) has a postinstall script that runs node beacon.cjs on npm install, and index.js calls the same code when the package is imported; it POSTs the hostname, install path and current working directory over plain HTTP to http://185.158.107.175:8787/_ah/dc, and index.js exports a Proxy that returns no-op functions so builds importing the real package keep running. The npm account wiseke published 14 such packages under the @greenlake, @sxm-web, @drone-js-ext and @ppa-web-components scopes between 2026-10-23 21:23 and 2026-10-25 14:28 UTC; index.js is byte-identical to that of ph-common (MAL-2026-1809), which sends to the same endpoint.

The package self-describes as a 'Compatibility shim' and exports an inert Proxy that returns no-op functions for every property, providing no functional API. Its only runtime behavior is a beacon in beacon.cjs that fires both from the npm postinstall lifecycle hook and on require() via index.js. The beacon collects the installer's OS hostname, __dirname install path, and process.cwd() (which commonly embed the Unix username and internal project/repo names) along with Node version, and POSTs them as JSON to the hardcoded plaintext bare-IP endpoint http://185.158.107.175:8787/_ah/dc with an x-beacon-package header identifying the resolving package. The scoped name @greenlake/* mimicking an internal namespace, the inert public API, and the automatic callback to a hardcoded bare-IP operator on install and import together match the shape of a dependency-confusion probe: resolving this package on an installer's machine silently discloses internal host, user, path, and namespace information to an external operator the installer did not opt into.

Malicious versions

2 flagged

3.0.099.0.1

Indicators of compromise (SHA-256)

5c391fc0f0acc51479adc96cdca5e63497f47dd4304eb0a871819bce9313551e

8ee1e5c23e641cce920808500ad850f4965adeb982b4c14233901c80c2cfb039

Detection & response playbook

Backdoor / remote access

Find it
Search your lockfiles and build artifacts for @greenlake/common-context (2 malicious versions).
If you installed it — respond
@greenlake/common-context establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.
Did it already run?
If @greenlake/common-context was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. @greenlake/common-context on npm has been identified as a malicious package (versions 3.0.0, 99.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-021703IN-MAL-2026-021718

References

Credits

Amazon Inspector · finder
InvisiRisk, Inc. · finder

Detect & block this

O3 blocks @greenlake/common-context-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database