Malicious code in console-fmt-cli (npm)
Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. `console-fmt-cli` uses a side-loader technique: it declares `decimal-format-core >=3.0` as a dependency, which contains a dropper that executes at install time via a `postinstall` hook. The dropper fetches a second-stage infostealer from a remote C2 (`logstream-api.online`) that harvests cryptocurrency wallet vaults (MetaMask, Phantom, Solflare, OKX, Coinbase, TrustWallet, Backpack, TronLink), browser cookies and credentials, SSH keys, AWS credentials, `.npmrc` tokens, Docker config, shell history, and password manager databases. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (62d4aa3c5f7523f4a10d37346a6eaa228940d76f797e13b6d2010385e81e4331) On every call to createLogger (the package's documented entrypoint), logger.js resolves the peer dependency decimal-format-core's private scripts/install-check.cjs path and invokes runRuntimeProjectSync() via setImmediate, wrapped in a try/catch that suppresses all errors. The README describes decimal-format-core as an optional formatting dependency, yet the logger unconditionally reaches into that dependency's internal scripts/ directory and executes a runtime function on ordinary library use. The trigger function is named queueRuntimeProjectSync and the invoked file is named install-check.cjs, both consistent with a cover story that hides script execution from the consumer. This package itself contains no exfiltration or network calls; its role is to act as a loader stub that shifts execution into decimal-format-core, whose install-check.cjs code determines the actual payload behavior.
AI Analysis
Technical Summary
The console-fmt-cli npm package is malicious due to its dependency on decimal-format-core >=3.0, which contains a dropper executing at install time through a postinstall hook. This dropper downloads a second-stage infostealer from logstream-api.online, designed to steal sensitive data including cryptocurrency wallets (MetaMask, Phantom, Solflare, OKX, Coinbase, TrustWallet, Backpack, TronLink), browser cookies, credentials, SSH keys, AWS credentials, .npmrc tokens, Docker configuration, shell history, and password manager databases. This threat is part of a coordinated DeFi-themed campaign targeting developer environments via npm packages.
Potential Impact
If installed, the malicious package can lead to theft of a wide range of sensitive data including cryptocurrency wallets, authentication credentials, cloud service keys, and local configuration files. This can result in unauthorized access to user accounts, financial loss, and compromise of developer environments. The malicious code executes automatically during package installation, increasing risk of unnoticed compromise.
Mitigation Recommendations
No official patch or fix is currently documented. Users should avoid installing the affected versions of console-fmt-cli listed and audit their dependencies for malicious packages. Remove any installations of console-fmt-cli versions =2.0.0, =2.1.0, =2.2.0, =2.3.0, =2.4.0, =2.5.0, =2.7.0, =2.8.0, and =2.9.0. Monitor for suspicious network activity related to logstream-api.online and consider rotating any potentially exposed credentials or keys. Check vendor advisories or npm security advisories for updates or remediation guidance.
Malicious code in console-fmt-cli (npm)
Description
Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. `console-fmt-cli` uses a side-loader technique: it declares `decimal-format-core >=3.0` as a dependency, which contains a dropper that executes at install time via a `postinstall` hook. The dropper fetches a second-stage infostealer from a remote C2 (`logstream-api.online`) that harvests cryptocurrency wallet vaults (MetaMask, Phantom, Solflare, OKX, Coinbase, TrustWallet, Backpack, TronLink), browser cookies and credentials, SSH keys, AWS credentials, `.npmrc` tokens, Docker config, shell history, and password manager databases. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (62d4aa3c5f7523f4a10d37346a6eaa228940d76f797e13b6d2010385e81e4331) On every call to createLogger (the package's documented entrypoint), logger.js resolves the peer dependency decimal-format-core's private scripts/install-check.cjs path and invokes runRuntimeProjectSync() via setImmediate, wrapped in a try/catch that suppresses all errors. The README describes decimal-format-core as an optional formatting dependency, yet the logger unconditionally reaches into that dependency's internal scripts/ directory and executes a runtime function on ordinary library use. The trigger function is named queueRuntimeProjectSync and the invoked file is named install-check.cjs, both consistent with a cover story that hides script execution from the consumer. This package itself contains no exfiltration or network calls; its role is to act as a loader stub that shifts execution into decimal-format-core, whose install-check.cjs code determines the actual payload behavior.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The console-fmt-cli npm package is malicious due to its dependency on decimal-format-core >=3.0, which contains a dropper executing at install time through a postinstall hook. This dropper downloads a second-stage infostealer from logstream-api.online, designed to steal sensitive data including cryptocurrency wallets (MetaMask, Phantom, Solflare, OKX, Coinbase, TrustWallet, Backpack, TronLink), browser cookies, credentials, SSH keys, AWS credentials, .npmrc tokens, Docker configuration, shell history, and password manager databases. This threat is part of a coordinated DeFi-themed campaign targeting developer environments via npm packages.
Potential Impact
If installed, the malicious package can lead to theft of a wide range of sensitive data including cryptocurrency wallets, authentication credentials, cloud service keys, and local configuration files. This can result in unauthorized access to user accounts, financial loss, and compromise of developer environments. The malicious code executes automatically during package installation, increasing risk of unnoticed compromise.
Mitigation Recommendations
No official patch or fix is currently documented. Users should avoid installing the affected versions of console-fmt-cli listed and audit their dependencies for malicious packages. Remove any installations of console-fmt-cli versions =2.0.0, =2.1.0, =2.2.0, =2.3.0, =2.4.0, =2.5.0, =2.7.0, =2.8.0, and =2.9.0. Monitor for suspicious network activity related to logstream-api.online and consider rotating any potentially exposed credentials or keys. Check vendor advisories or npm security advisories for updates or remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-6688
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a4f6c7068715ace4315aa28
Added to database: 07/09/2026, 09:40:00 UTC
Last enriched: 07/09/2026, 10:07:15 UTC
Last updated: 07/25/2026, 09:26:08 UTC
Views: 33
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.