14 npm packages used in dependency-confusion campaign

An npm account named wiseke published 14 packages across four scopes (@greenlake, @sxm-web, @drone-js-ext, @ppa-web-components) between 23 and 25 October 2026, posing as internal SDKs. GitHub's Advisory Database flagged them as malware: a postinstall script sends the hostname, install path and working directory over plain HTTP to 185.158.107.175:8787.

• 14 packages across 4 scopes published within two days, 23–25 October
• Malicious code beacons machine data to 185.158.107.175:8787 over HTTP
• index.js exports a Proxy of no-op functions so builds keep compiling
• Version 13.3.7 was chosen to look mature rather than freshly published