MAL-2026-16054

    Dashboard / Malicious Package / MAL-2026-16054

    MAL-2026-16054

    Published: 9 Sept 2026Last Modified: 9 Sept 2026

    Summary: Malicious code in gloggo (npm)

    Details: Source: amazon-inspector (a333f8ded17af0754357d938933ee95e9ab1f857cc875948d49cb9b26992e75d) gloggo impersonates the legitimate gulpjs 'glogg' logging library by copying its README, shields, and LICENSE text (attributed to Blaine Bublitz), while package.json attributes authorship to 'Blockvora Team <[email protected]>' with repository 'blockvora/gloggo'. The package name is a one-character variant of 'glogg'. getLogger() invokes isSign('favorite','gloggo',12467) from the dependency 'file-type-detector' and, when that gate returns truthy, executes require('./log'). The './log' module is not present in the tarball, so its bytes must be produced or supplied at require time by the dependency. A logging utility has no legitimate reason to gate its loader on an opaque file-signature check from an unrelated third-party dependency, and the gated path executes code that is not part of the shipped package contents. Consumers who install gloggo believing it to be glogg import a typosquat that conditionally runs code sourced from a suspicious sibling dependency when the module is required.

    References: https://www.npmjs.com/package/gloggo/v/1.1.3, https://www.npmjs.com/package/gloggo/v/1.1.4, https://www.npmjs.com/package/gloggo/v/1.1.2

    Affected packages

    Package

    Name: gloggo

    Purl: pkg:npm/gloggo

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.1.3
    1.1.4
    1.1.2