MAL-2026-2907

    Dashboard / Malicious Package / MAL-2026-2907

    MAL-2026-2907

    Published: 16 Apr 2026Last Modified: 23 Apr 2026

    Summary: Malicious code in nj-logger (npm)

    Details: nj-logger is a malicious npm package that when imported in file dist/logger/telemetry.js downloads a trojan (for Windows only, W64.AIDetectMalware / Trojan.Malware.300983.susgen) from http://178.128.88[.]40:8080/download/svc to path node_modules/.cache/nj-logger/nj-transport-win32-x64.node and executes it. Downloader is obfuscated as telemetry module, urls & paths are base64 and XOR encoded. Source: amazon-inspector (35414b2bda6d20336301bfdc5c0147a6434ee0e712f1fd5962a61ef34d6e53e9) The package nj-logger was found to contain malicious code.

    References:

    Affected packages

    Package

    Name: nj-logger

    Purl: pkg:npm/nj-logger

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    MAL-2026-2907 | CVE-DB