log-min

{"modified":"2026-08-05T12:35:07Z","published":"2026-08-05T12:35:07Z","schema_version":"1.7.4","id":"MAL-2026-12396","summary":"Malicious code in log-min (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5dc78815e8c40947273929a7224aa04230de911771e62580045fb8bb213468c9)\nThe package publishes as 'log-min' with a description claiming it is a JavaScript library for the Theta Blockchain, while its README identifies the project as 'chain-sdk-js' — an impersonation of the Theta chain-sdk-js SDK. package.json declares postinstall 'node src', which loads src/providers/BaseProvider.js. That module's top-level IIFE imports an opaque blob 'desKey' from the 'thedata' npm dependency, DES-decrypts it with the hardcoded password 'hydra', spawns a detached 'node' child process with piped stdin and ignored stdio, writes the decrypted code into the child's stdin, and unrefs the child so it survives the installer. The identical decrypt-and-exec pattern is also present at the top level of the shipped CJS bundle dist/log-min.cjs.js, so the dropper fires both at 'npm install' via the postinstall hook and whenever any consumer require()s the package. The executed bytes originate in a separate dependency ('thedata') and are not present in the log-min tarball, giving the author of that dependency arbitrary code execution on any machine that installs or imports log-min.\n","affected":[{"package":{"ecosystem":"npm","name":"log-min"},"versions":["1.0.13"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/providers/BaseProvider.js","sha256":"760f0299e1f8201b5366de8c37a4df3e4f796c862da4c2eec5431b8a2be05197","tlsh":"8f51fe2536fb613146a770a32bef9011703ad0433a0cce58badc87865fdc86c8da5fa5"},{"path":"dist/log-min.cjs.js","sha256":"8c9ea0104112308525f04b246b549c4e3621812de042385fb3bcda27bc83ac26","tlsh":"6e63939d26e7a060815b70b56fdb94407129e00b68ccd82cbdac53958fd946c9bf2ff8"},{"path":"README.md","sha256":"187a68752ff810e9a95953b762d721943c751f0fbb8713d628bed4a3a1b1646d","tlsh":"9301d0f7970b212531930a5d269256e89e57930699520cec00e933b4d759397c83e745"}],"package_integrity":[{"filename":"log-min-1.0.13.tgz","hashes":{"sha1":"ec3cd6f6799dc1bc35d0968a7a9d059df43593aa","sha512_sri":"sha512-DDzr/N829I7R4Y5B6N35mjEz3q7pBGkvo9yjJuNStF7MutRyfuKdzRzlLDRkzCLK+Uz4QM2Jt623J73tqrzwFg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/log-min/v/1.0.13"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014716","import_time":"2026-08-05T13:08:40.245100227Z","modified_time":"2026-08-05T12:35:07Z","sha256":"5dc78815e8c40947273929a7224aa04230de911771e62580045fb8bb213468c9","source":"amazon-inspector","versions":["1.0.13"]}]}}