@meziizana/frontend-logger (npm) · Malicious Code
Affects @meziizana/frontend-loggerSource GCVE Database
Malicious package : remove @meziizana/frontend-logger and rotate any secrets on hosts that installed it.
Data as of 13 Jul 2026, 09:58 UTC
Malicious package
Published to npm · OSV MAL-2026-10208
What to do
Remove @meziizana/frontend-logger from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npm@meziizana/frontend-logger | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package @meziizana/frontend-logger version 10.0.0 contains malicious code that executes a preinstall script during npm install. This script sends the installer's username, current working directory, and hostname to a third-party endpoint at webhook.site without user consent. The destination is a public request-inspection service commonly abused for data exfiltration, indicating unauthorized reconnaissance activity.