@ferudionz/web_logger_js (npm) · Malicious Code
Affects @ferudionz/web_logger_jsSource GCVE Database
Malicious package : remove @ferudionz/web_logger_js and rotate any secrets on hosts that installed it.
Data as of 15 Aug 2026, 05:42 UTC
Malicious package
Published to npm · OSV MAL-2026-14044
What to do
Remove @ferudionz/web_logger_js from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npm@ferudionz/web_logger_js | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package @ferudionz/web_logger_js version 1.0.0 contains obfuscated malicious code that exfiltrates data to an author-controlled endpoint. The package exports a function that sends its input to a hidden URL assembled at runtime, likely targeting EVM/crypto account identifiers or keys. The obfuscation includes RC4 decoding, anti-debug wrappers, and runtime string reconstruction to conceal the network destination. This behavior is not documented and indicates intentional data theft rather than a legitimate service call.