Malicious code in grafeno-logger (npm)

The grafeno-logger npm package (versions 1.0.0 and 1.0.1) contains a malicious preinstall lifecycle hook that runs a shell command to fetch and execute a remote script from a hardcoded IP address (216.126.236.46) via curl over plain HTTP. This script is executed synchronously during npm install using child_process.execSync. Additionally, the preinstall step adds a crontab entry that triggers the same remote script every 30 minutes, establishing persistent remote code execution under the installing user's privileges. The package's index.js is a minimal stub that simply re-exports console logging functions, providing no real logging features, thus acting as a decoy for the malicious payload.

Users who install grafeno-logger versions 1.0.0 or 1.0.1 risk executing arbitrary code fetched from an attacker-controlled server. This leads to persistent remote code execution on the affected system with the privileges of the installing user. The cron job ensures ongoing compromise every 30 minutes, potentially allowing attackers to maintain control, exfiltrate data, or perform other malicious activities.

No official patch or fix is currently documented for grafeno-logger. Users should avoid installing this package entirely. If already installed, remove the package and any associated cron jobs to eliminate the persistent remote code execution. Monitor and audit systems for signs of compromise. Since no vendor advisory or patch information is available, check trusted sources regularly for updates or official remediation guidance.