{"id":"MAL-2026-12396","summary":"Malicious code in log-min (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5dc78815e8c40947273929a7224aa04230de911771e62580045fb8bb213468c9)\nThe package publishes as 'log-min' with a description claiming it is a JavaScript library for the Theta Blockchain, while its README identifies the project as 'chain-sdk-js' — an impersonation of the Theta chain-sdk-js SDK. package.json declares postinstall 'node src', which loads src/providers/BaseProvider.js. That module's top-level IIFE imports an opaque blob 'desKey' from the 'thedata' npm dependency, DES-decrypts it with the hardcoded password 'hydra', spawns a detached 'node' child process with piped stdin and ignored stdio, writes the decrypted code into the child's stdin, and unrefs the child so it survives the installer. The identical decrypt-and-exec pattern is also present at the top level of the shipped CJS bundle dist/log-min.cjs.js, so the dropper fires both at 'npm install' via the postinstall hook and whenever any consumer require()s the package. The executed bytes originate in a separate dependency ('thedata') and are not present in the log-min tarball, giving the author of that dependency arbitrary code execution on any machine that installs or imports log-min.\n","modified":"2026-08-05T13:35:34.750530540Z","published":"2026-08-05T12:35:07Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-05T13:08:40.245100227Z","modified_time":"2026-08-05T12:35:07Z","sha256":"5dc78815e8c40947273929a7224aa04230de911771e62580045fb8bb213468c9","source":"amazon-inspector","versions":["1.0.13"],"id":"IN-MAL-2026-014716"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/log-min/v/1.0.13"}],"affected":[{"package":{"name":"log-min","ecosystem":"npm","purl":"pkg:npm/log-min"},"versions":["1.0.13"],"database_specific":{"indicators":{"evidence_files":[{"path":"src/providers/BaseProvider.js","sha256":"760f0299e1f8201b5366de8c37a4df3e4f796c862da4c2eec5431b8a2be05197","tlsh":"8f51fe2536fb613146a770a32bef9011703ad0433a0cce58badc87865fdc86c8da5fa5"},{"tlsh":"6e63939d26e7a060815b70b56fdb94407129e00b68ccd82cbdac53958fd946c9bf2ff8","path":"dist/log-min.cjs.js","sha256":"8c9ea0104112308525f04b246b549c4e3621812de042385fb3bcda27bc83ac26"},{"sha256":"187a68752ff810e9a95953b762d721943c751f0fbb8713d628bed4a3a1b1646d","tlsh":"9301d0f7970b212531930a5d269256e89e57930699520cec00e933b4d759397c83e745","path":"README.md"}],"package_integrity":[{"filename":"log-min-1.0.13.tgz","hashes":{"sha512_sri":"sha512-DDzr/N829I7R4Y5B6N35mjEz3q7pBGkvo9yjJuNStF7MutRyfuKdzRzlLDRkzCLK+Uz4QM2Jt623J73tqrzwFg==","sha1":"ec3cd6f6799dc1bc35d0968a7a9d059df43593aa"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/log-min/MAL-2026-12396.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}