MAL-2026-12396

    Dashboard / Malicious Package / MAL-2026-12396

    MAL-2026-12396

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in log-min (npm)

    Details: Source: amazon-inspector (5dc78815e8c40947273929a7224aa04230de911771e62580045fb8bb213468c9) The package publishes as 'log-min' with a description claiming it is a JavaScript library for the Theta Blockchain, while its README identifies the project as 'chain-sdk-js' — an impersonation of the Theta chain-sdk-js SDK. package.json declares postinstall 'node src', which loads src/providers/BaseProvider.js. That module's top-level IIFE imports an opaque blob 'desKey' from the 'thedata' npm dependency, DES-decrypts it with the hardcoded password 'hydra', spawns a detached 'node' child process with piped stdin and ignored stdio, writes the decrypted code into the child's stdin, and unrefs the child so it survives the installer. The identical decrypt-and-exec pattern is also present at the top level of the shipped CJS bundle dist/log-min.cjs.js, so the dropper fires both at 'npm install' via the postinstall hook and whenever any consumer require()s the package. The executed bytes originate in a separate dependency ('thedata') and are not present in the log-min tarball, giving the author of that dependency arbitrary code execution on any machine that installs or imports log-min.

    References: https://www.npmjs.com/package/log-min/v/1.0.13

    Affected packages

    Package

    Name: log-min

    Purl: pkg:npm/log-min

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.13
    MAL-2026-12396 | CVE-DB