MAL-2026-14292

    Dashboard / Malicious Package / MAL-2026-14292

    MAL-2026-14292

    Published: 19 Aug 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in log-res (npm)

    Details: Source: amazon-inspector (59f23ea1c6c40021fb69210eba68cdbda94b42f4e255f78758778b90ebb09d78) index.js re-exports a `desKey` string sourced from apps/docs/app/theta.js, which reads apps/docs/app/des.db as UTF-8. des.db contains a heavily obfuscated JavaScript program (string-array + hex-name mangling) that, when evaluated, creates a directory under the OS temp directory, writes a synthetic package.json declaring runtime dependencies on axios, better-sqlite3, node-machine-id, and socket.io-client, spawns `npm install` inside that directory, and then spawns `node` on a staged index.js. The payload is disguised as a database file (`des.db`) rather than shipped as source, and the stager fetches and runs a socket.io-client-based remote agent capable of receiving commands from an attacker-controlled endpoint. The package's advertised purpose (a docs/monorepo TheData API helper) does not require embedding or exporting an obfuscated executable blob.

    References: https://www.npmjs.com/package/log-res/v/1.0.3

    Affected packages

    Package

    Name: log-res

    Purl: pkg:npm/log-res

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.3