{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "js-logger-pack"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "SEMVER"
        }
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "https://safedep.io"
      ],
      "name": "SafeDep",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": null
  },
  "details": "js-logger-pack is a fake npm logger that the attacker developed openly on the registry over 23 versions across two weeks (2026-04-01 to 2026-04-15). Version 1.1.20, published hours after initial detection, is a re-obfuscation of the same payload with a new hash \u2014 same C2, same capabilities. Early versions were harmless probes; version 1.1.5 introduced the first weaponized payload with unobfuscated TypeScript source that accidentally leaked the attacker\u2019s SSH RSA public key (bink@DESKTOP-N8JGD6T) and their original C2 domain (api-sub.jrodacooker[.]dev). Subsequent versions replaced the readable source with a 885 KB custom base64 bytecode VM and swapped the domain for a raw Hetzner IP. The payload is a long-running WebSocket agent that: installs the attacker\u2019s RSA key into ~/.ssh/authorized_keys on Linux; exfiltrates Telegram Desktop tdata sessions; drains credentials from 27 crypto wallets and Chromium-family browsers; steals .npmrc, cloud provider tokens, and shell history; and runs a native keylogger on Windows, macOS, and Linux with autostart persistence on all three.",
  "id": "MAL-2026-2827",
  "modified": "2026-04-15T06:24:12Z",
  "published": "2026-04-15T06:24:12Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://safedep.io/malicious-js-logger-pack-npm-stealer/"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in js-logger-pack (npm)"
}