@ferudionz/web_logger_js

{"modified":"2026-08-14T19:03:43Z","published":"2026-08-14T19:03:43Z","schema_version":"1.7.4","id":"MAL-2026-14044","summary":"Malicious code in @ferudionz/web_logger_js (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (42924eef53202ac8b42a142da91ff30445dab53dcf185fa4798efd4d40d1b095)\nThe package ships a single obfuscator.io-style `index.js` with a rotated string array, RC4 key-schedule + XOR string decoder, self-defending anti-debug wrapper, and per-call proxy functions. All identifiers (the `require` target, the HTTP method name, and the destination URL) are reconstructed at runtime from ~130 encoded literals, hiding the actual network destination from static inspection. The sole exported function `connet(x)` unconditionally issues `axios.get(API_BASE_URL + x)` where `API_BASE_URL` is a URL assembled at runtime from ~13 RC4-decoded fragments. Any consumer that calls the package's public API sends its argument to a hardcoded author-controlled destination the caller did not configure. The README hint (`npm install evm_account`) and the name mismatch between the published package and its documented install string are consistent with an EVM/crypto-account-targeted exfiltration helper: a caller passing an account identifier, address, key material, or similar input to `connet()` will silently leak it to the obfuscated endpoint. The concealment of the destination behind RC4 decoding and anti-debug wrapping rules out an inadvertent, documented service call.\n","affected":[{"package":{"ecosystem":"npm","name":"@ferudionz/web_logger_js"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"ae4ad972bd2947f3336256936dd1080991040aa80763033f1e1d5192725f8f7a","tlsh":"7dd2cc9473c1f803228f5b63bf16a9ece52aa8b678c8544be114b89cf4b9407d5b4df0"}],"package_integrity":[{"filename":"web_logger_js-1.0.0.tgz","hashes":{"sha1":"7ac8d2737d3e80cf365e6f62002ee9242c639476","sha512_sri":"sha512-fo9PPTXggc1DHrFA0j0F9Ri2/aGXlsvi3QiKuxXhaXTHmzKRPOsErxgBqRWYGKAtoKpo/vbpCIf3G0OsqupMqA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ferudionz/web_logger_js/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017915","import_time":"2026-08-14T19:24:34.124706517Z","modified_time":"2026-08-14T19:03:43Z","sha256":"42924eef53202ac8b42a142da91ff30445dab53dcf185fa4798efd4d40d1b095","source":"amazon-inspector","versions":["1.0.0"]}]}}