MAL-2026-14044
Dashboard / Malicious Package / MAL-2026-14044
MAL-2026-14044
Summary: Malicious code in @ferudionz/web_logger_js (npm)
Details: Source: amazon-inspector (42924eef53202ac8b42a142da91ff30445dab53dcf185fa4798efd4d40d1b095) The package ships a single obfuscator.io-style `index.js` with a rotated string array, RC4 key-schedule + XOR string decoder, self-defending anti-debug wrapper, and per-call proxy functions. All identifiers (the `require` target, the HTTP method name, and the destination URL) are reconstructed at runtime from ~130 encoded literals, hiding the actual network destination from static inspection. The sole exported function `connet(x)` unconditionally issues `axios.get(API_BASE_URL + x)` where `API_BASE_URL` is a URL assembled at runtime from ~13 RC4-decoded fragments. Any consumer that calls the package's public API sends its argument to a hardcoded author-controlled destination the caller did not configure. The README hint (`npm install evm_account`) and the name mismatch between the published package and its documented install string are consistent with an EVM/crypto-account-targeted exfiltration helper: a caller passing an account identifier, address, key material, or similar input to `connet()` will silently leak it to the obfuscated endpoint. The concealment of the destination behind RC4 decoding and anti-debug wrapping rules out an inadvertent, documented service call.
Affected packages
Package
Name: @ferudionz/web_logger_js
Purl: pkg:npm/%40ferudionz/web_logger_js
Affected ranges
Type: N/A
Events:
