MalwarePublished 10 Jul 2026

notify-dist (npm) · Malicious Code

Affects notify-distSource GCVE Database

Malicious package : remove notify-dist and rotate any secrets on hosts that installed it.

Data as of 12 Jul 2026, 09:18 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10154

What to do

Remove notify-dist from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmnotify-dist	Affected =1.3.7	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (1cf89f8fbe4c3f9ae9494077688977f46c8b3f875a552054508ac5eec7b62344) notify-dist advertises itself as a pino-compatible logger/middleware (exports `module.exports.pino`, keywords fast/logger/stream/json, lib/ mirrors pino internals such as proto.js, multistream.js, redaction.js, transport.js), but the exported middleware's only side effect is to launch a remote-code loader. When a consumer requires the package and invokes the exported middleware, index.js spawns `node lib/caller.js` as a detached child with `stdio: 'ignore'` and `child.unref()` so the loader survives after the parent exits. lib/caller.js issues an HTTP GET to https://jsonkeeper.com/b/BPB86 via axios, reads the `.cookie` field of the response, and executes it as JavaScript via `new Function.constructor('require', s)(require)`, giving the fetched code full Node privileges including `require`. The loader retries up to 5 times and silences console.log to hide activity. lib/const.js additionally holds base64-encoded fields that decode to a second endpoint (https://jsonkeeper.com/b/ZK45J) and header name `x-secret-key`, serving as a rotation/backup payload URL. jsonkeeper.com is a mutable third-party JSON paste host, so the executed code is fully attacker-controlled and can change at any time. The pino-shaped API surface is a lure: consumers importing this expecting logger behavior get arbitrary remote code execution on their machine.

Impact

Any application or developer that installs and uses notify-dist version 1.3.7 is at risk of arbitrary remote code execution. The attacker-controlled payload can execute any code with the same privileges as the Node.js process, potentially leading to full system compromise, data theft, or further malware deployment. Because the payload is fetched from a mutable third-party JSON host, the malicious code can change dynamically, increasing the risk and difficulty of detection.

Defensive guidance

Users should immediately remove this package from their projects and avoid installing it. Since the package is malicious by design, replacing it with a legitimate logging library such as the official pino package is recommended. Monitor dependencies carefully to prevent inclusion of similarly malicious packages.

Summary

Notify-dist version 1.3.7 is a malicious npm package that pretends to be a pino-compatible logger but instead executes remote code. Upon invocation, it spawns a detached child process that performs HTTP GET requests to attacker-controlled URLs hosted on jsonkeeper.com. The fetched JavaScript code is executed with full Node.js privileges using the Function constructor, allowing arbitrary code execution. The package uses multiple endpoints for payload rotation and suppresses console logs to evade detection. This results in a remote code execution vulnerability triggered simply by requiring and invoking the package's exported middleware.

References

npmjs.com/package/notify-dist/v/1.3.7 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 11 Jul 2026, 10:04 UTC

Technical details

References

Community reviews