MAL-2026-7017

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/logger-daemon-regex/MAL-2026-7017.json

JSON Data

https://api.test.osv.dev/v1/vulns/MAL-2026-7017

Published

2026-07-08T19:30:30Z

Modified

2026-07-08T19:46:38.702809343Z

Summary

Malicious code in logger-daemon-regex (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (867d520b17da5e885d1a1e1e954cbf9eaf045b55a28307319f4fbad27846b8a9)

package.json advertises the package as a 'Node.js integration layer for Autodesk Forge' but the shipped code is a full information-stealer / remote-access implant. On npm install, scripts.postinstall chains scripts/postinstall-agent.mjs, which (a) copies dist/ into a hidden per-user runtime prefix at <userdata>/.logger-daemon-regex/runtime/v<version>/ so the agent survives npm uninstall, (b) registers OS autostart against that hidden copy via cli-autostart.js, and (c) spawns a detached, windowsHide, unref'd node process running dist/cli-agent.js. The agent opens a WebSocket to a C2 host whose address is not present as plaintext: dist/deploymentDefaults.js reconstructs a 32-byte AES-256-GCM key by XOR-ing two obfuscated Uint8Array halves (DEPLOYMENTKEYA^DEPLOYMENTMASKA, DEPLOYMENTKEYB^DEPLOYMENTMASKB) and decrypts DEPLOYMENTCIPHERTEXTB64 (with IV/TAG) into publicHost / relayPort / apiPort / defaultExplorerPassword, from which ws://<host>:<port> is derived at runtime. Once connected, the agent runs dist/secretScan/agentStartupAudit.js, which walks POSIX '/' or every Windows drive and matches files by name and content against rules in dist/secretScan/contentScanner.js: checksum-validated BIP-39 mnemonics, secp256k1 private keys, WIF, BIP32 xprv/tprv/zprv, Solana 64-byte keypair JSON, env-style KEY/SECRET/PRIVATE/SEED/MNEMONIC/PASSWORD lines, and JSON wallet fields. Matches (with full secret material by default) are packaged into agents/<hostname>/result.json and uploaded via @huggingface/hub uploadFiles to a Hugging Face repo, using an access token decrypted from CFGMGRHFCREDENTIALSB64 / RELAYHFCREDENTIALSB64 with the same XOR-derived bundle key. dist/shellHistoryScan.js separately enumerates ~/.bashhistory, ~/.zshhistory, ~/.pythonhistory, ~/.nodereplhistory, ~/.mysqlhistory, ~/.psqlhistory, ~/.sqlitehistory, ~/.lesshst, fish history, Windows PowerShell PSReadLine ConsoleHosthistory.txt, Clink history, and Cygwin/msys homes, streaming records through syncClient to the same C2 relay. dist/hostInventorySend.js unconditionally POSTs hostname + os.type/platform/release/version + Node version to the same relay. dist/chromiumExtensionDbHarvest.js + dist/extensionDbHfUpload.js target Chromium/Chrome/Edge extension LevelDB stores (browser wallets, session cookies) and are enabled by default via FORGEJSAGENTEXTENSIONDBHFUPLOAD='1' set in postinstall-agent.mjs's turnkeySpawnEnvOverrides. dist/index.js additionally re-exports relayAgent, windowsInputSync, clipboardEventWatcher, discordRelayUpload, and workerBootstrap, giving the C2 operator keyboard/clipboard capture, screenshot exfiltration (handleDiscordScreenshotUploadFromAgent), and arbitrary file upload. The near-duplicate bin entries (forge-jsx-explorer-, forge-jsy-explorer-, logger-daemon-regex-explorer-kill-agent) and CFGMGR_* / FORGEJS* env-var namespaces reinforce the Autodesk Forge / cfgmgr impersonation cover story.

Database specific

{
    "malicious-packages-origins": [
        {
            "versions": [
                "1.0.124"
            ],
            "id": "IN-MAL-2026-008254",
            "import_time": "2026-07-08T19:33:49.938331025Z",
            "modified_time": "2026-07-08T19:30:30Z",
            "source": "amazon-inspector",
            "sha256": "867d520b17da5e885d1a1e1e954cbf9eaf045b55a28307319f4fbad27846b8a9"
        }
    ]
}

References

https://www.npmjs.com/package/logger-daemon-regex/v/1.0.124

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / logger-daemon-regex

Package

Name: logger-daemon-regex; View open source insights on deps.dev
Purl: pkg:npm/logger-daemon-regex

Affected ranges

Affected versions

1.*

1.0.124

Database specific

indicators

{
    "package_integrity": [
        {
            "filename": "logger-daemon-regex-1.0.124.tgz",
            "hashes": {
                "sha1": "1eadec82669c3d7d975d2d14876663b74c8ce62e",
                "sha512_sri": "sha512-UobexGbWMYauCYHiPkX0Re3uXIeXkyI/kqFxLPtJzSzDLQHNLdN1ES1voXSt4YDW43j5YbZVfMmywMffhj05aQ=="
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "3292e88ce6e71a7606a1e79d7a1f150667a0d1470648e4b4f0dd82887f2d03d83b7ebe",
            "sha256": "9822fa46896aba178c533b4ed1579ec737869984dc44760dc3ad618c39614118",
            "path": "scripts/postinstall-agent.mjs"
        },
        {
            "tlsh": "e1f16549b8e7b0100663b5f8861bc8973bdcad07260ed444b35e93956f1f831a3b76e6",
            "sha256": "cbf70b0d8654138a0b4dfcb152824c85fecab500e1a5fade53c2049da4c0dc48",
            "path": "dist/deploymentDefaults.js"
        },
        {
            "tlsh": "a3e2eb9a69f32432826371be5a4f9005f660b427214ce8a47a5cc299ff454b8d3f7fd8",
            "sha256": "a4ebea897ca7712bd57c1c1cb3ffa74c409bbce225195689f6bc63c6d212cb56",
            "path": "dist/secretScan/agentStartupAudit.js"
        },
        {
            "tlsh": "38f1656b4af7603901e3a2bc5f7f5001b25454132249df463b9cce8c9f7d92893a5e9e",
            "sha256": "18d57bd7b11bef6d24e62e7ce699fff251780d1b336da7c5442701966fcac832",
            "path": "dist/shellHistoryScan.js"
        },
        {
            "tlsh": "df81938429f6bab417a323a89b7fd042b7749543201df0787a0c83982f6d44652fefe1",
            "sha256": "6034fa08d4dad02d7576d383e30505fcfd3f864e528f439d025a053e10e32f98",
            "path": "dist/hostInventorySend.js"
        },
        {
            "tlsh": "aed1cc0b7588b6f047ec70ecdb5be0c2f9a65c2700a025a8939cdbb9ec375db90d1919",
            "sha256": "f4750543b79e65a25880f6c8533f0dfd1bb4d4e55cb733bf793ab006db1ddbbd",
            "path": "dist/index.js"
        },
        {
            "tlsh": "2e918d9ccc2b8df215e24f9a24604140bd31c18f4c487696b7af676c8fad16f04bba1c",
            "sha256": "7f566e72c9d5301dd933962a66ee107aadf0fc08334ffbd4069a7a1ec4e80666",
            "path": "package.json"
        }
    ]
}

cwes

[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/logger-daemon-regex/MAL-2026-7017.json"