Malicious code in log-res (npm)

The log-res npm package version 1.0.3 includes a heavily obfuscated JavaScript payload embedded in a file named des.db, which is read and evaluated at runtime. This payload creates a directory under the OS temporary folder, writes a synthetic package.json declaring dependencies on axios, better-sqlite3, node-machine-id, and socket.io-client, then runs npm install and executes a staged index.js. The staged code establishes a socket.io-client connection to a remote attacker-controlled endpoint, allowing command execution. The malicious payload is disguised as a database file rather than shipped as source code, and the package's stated purpose does not justify this behavior.

This malicious code enables remote command execution by connecting to an attacker-controlled server, potentially allowing full compromise of the host running the package. It installs additional dependencies and executes arbitrary code, which can lead to data theft, system manipulation, or further malware deployment. Since the payload is obfuscated and disguised, it may evade detection by standard code reviews or automated tools.

No official patch or remediation is currently documented. Users should avoid using log-res version 1.0.3 and remove it from their environments. Verify dependencies and source integrity before installation. Monitor for any suspicious network connections or unexpected npm install activity originating from this package. Check vendor or repository advisories for updates or official fixes.