Skip to main content
MalwarePublished Updated

console-fmt-cli (npm) · Malicious Code

Affects console-fmt-cliSource GCVE Database

0

Malicious package : remove console-fmt-cli and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 15:56 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6688

What to do

Remove console-fmt-cli from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

ProductAffectedFixed in
npmconsole-fmt-cliAffected
  • 2.0.0 – 2.9.1
11 affected builds		Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. `console-fmt-cli` uses a side-loader technique: it declares `decimal-format-core >=3.0` as a dependency, which contains a dropper that executes at install time via a `postinstall` hook. The dropper fetches a second-stage infostealer from a remote C2 (`logstream-api.online`) that harvests cryptocurrency wallet vaults (MetaMask, Phantom, Solflare, OKX, Coinbase, TrustWallet, Backpack, TronLink), browser cookies and credentials, SSH keys, AWS credentials, `.npmrc` tokens, Docker config, shell history, and password manager databases. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (62d4aa3c5f7523f4a10d37346a6eaa228940d76f797e13b6d2010385e81e4331) On every call to createLogger (the package's documented entrypoint), logger.js resolves the peer dependency decimal-format-core's private scripts/install-check.cjs path and invokes runRuntimeProjectSync() via setImmediate, wrapped in a try/catch that suppresses all errors. The README describes decimal-format-core as an optional formatting dependency, yet the logger unconditionally reaches into that dependency's internal scripts/ directory and executes a runtime function on ordinary library use. The trigger function is named queueRuntimeProjectSync and the invoked file is named install-check.cjs, both consistent with a cover story that hides script execution from the consumer. This package itself contains no exfiltration or network calls; its role is to act as a loader stub that shifts execution into decimal-format-core, whose install-check.cjs code determines the actual payload behavior.

References

Community reviews

Loading reviews…