MalwarePublished 6 Jul 2026Updated 14 Jul 2026

enbd-react-logger (npm) · Malicious Code

Affects enbd-react-loggerSource GCVE Database

Malicious package : remove enbd-react-logger and rotate any secrets on hosts that installed it.

Data as of 14 Jul 2026, 09:37 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10231

What to do

Remove enbd-react-logger from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmenbd-react-logger	Affected =4.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The enbd-react-logger npm package version 4.0.0 is a malicious package published as part of a dependency confusion attack targeting organizations using an internal 'enbd' namespace. It contains a preinstall script that executes automatically during npm install, sending the host's public IP address, hostname, OS username, and runtime metadata to an attacker-controlled Sentry project without user consent. This behavior enables reconnaissance by the attacker to identify successful installs and affected organizations. The package also hardcodes the attacker's Sentry DSN, causing any downstream error reporting to leak data to the attacker. Removal of the package alone may not fully remediate the compromise, as the attacker may have gained broader control of the system.

Impact

Installation of this package results in unauthorized exfiltration of sensitive host telemetry and personally identifiable information (PII) including public IP address, hostname, OS username, and runtime environment metadata to an attacker-controlled Sentry project. This compromises confidentiality and privacy of the affected system. The attacker can identify which organizations have installed the package, enabling targeted follow-up attacks. The presence of the malicious preinstall script means that the compromise occurs before application code runs, increasing risk. According to external malware analysis, any system with this package installed or running should be considered fully compromised, and all secrets and keys on that system should be rotated from a different, trusted machine. Removal of the package alone does not guarantee full remediation.

Defensive guidance

The recommended mitigation is to immediately remove the enbd-react-logger package version 4.0.0 from all affected systems. Because the package executes code at install time and exfiltrates sensitive data, assume full system compromise upon installation. Rotate all secrets, credentials, and keys that were stored or accessible on the affected systems, performing this rotation from a separate, trusted environment. Review and correct any misconfigured dependency resolution to prevent accidental installation of public packages mimicking internal namespaces. Monitor for any further suspicious activity related to this package or similar dependency confusion attacks. There is no vendor advisory indicating any official fix or that no action is required.

Summary

The enbd-react-logger package (version 4.0.0) was published to the npm registry by an attacker impersonating an internal package namespace used by Emirates NBD. It includes a preinstall hook that runs automatically on npm install, executing a script that initializes the @sentry/node client with a hardcoded attacker-owned Sentry DSN and sendDefaultPii enabled. This script collects the installing host's public egress IP by querying Cloudflare's trace endpoint and deliberately triggers a runtime exception to send telemetry data including public IP, hostname, OS username, and environment metadata to the attacker's Sentry project. This enables the attacker to perform reconnaissance on victims who mistakenly install this public package due to misconfigured dependency resolution. The attack is part of a broader campaign using similar packages targeting different internal namespaces, each beaconing to distinct Sentry project IDs. The package's malicious behavior is embedded in the install-time payload and the source code, making it a severe threat. The package version affected is exactly 4.0.0.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Jul 2026, 09:37 UTC

Technical details

References

Community reviews