MalwarePublished 10 Jul 2026

notify-logs (npm) · Malicious Code

Affects notify-logsSource GCVE Database

Malicious package : remove notify-logs and rotate any secrets on hosts that installed it.

Data as of 12 Jul 2026, 09:18 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10156

What to do

Remove notify-logs from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmnotify-logs	Affected =1.3.5	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (fec337f1c1858ad605f875ea51feb09f84fbd2eb702c7bc0462dbb427b3eff05) notify-logs@1.3.5 presents itself as the `pino` logger (export name `pino`, README and type definitions mimic pino, npm version badge points at the legitimate pino package) but its runtime behavior is a remote-code dropper. index.js exports middleware that, on first invocation, uses child_process.spawn to launch a detached `node` process running lib/caller.js with stdio ignored. lib/caller.js performs an HTTP GET against https://jsonkeeper.com/b/EXSIF (a mutable anonymous JSON-paste host), reads `.data.cookie` from the response, and passes that string to `new Function.constructor("require", s)` then invokes it with the real `require` — compiling and executing attacker-controlled JavaScript inside the consumer's Node process with full module access. lib/const.js additionally stores a base64-encoded fallback endpoint (`aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL1pLNDVK` → https://jsonkeeper.com/b/ZK45J) along with base64-encoded header name/value, hiding the secondary C2 from plain-string scanners. The combination of logger impersonation, opaque remote payload from an anonymous mutable host, detached/silent execution, and obfuscated fallback endpoint is unambiguous supply-chain abuse: any application that loads and invokes this middleware grants the publisher arbitrary code execution.

Impact

Any application that installs and invokes notify-logs@1.3.5 middleware is vulnerable to arbitrary remote code execution controlled by the attacker. This can lead to full compromise of the host system, data theft, persistence, and further malicious activity. The malicious payload is fetched dynamically from a mutable anonymous JSON paste service, allowing the attacker to change the executed code at will. The obfuscation and detached execution make detection difficult.

Defensive guidance

Users should immediately remove this package from their dependencies and replace it with the legitimate pino logger or another trusted logging library. Avoid installing or running any code from notify-logs@1.3.5. Monitor your environment for any signs of compromise if this package was previously used.

Summary

The notify-logs package version 1.3.5 masquerades as the pino logger by mimicking its export name, README, and type definitions. However, its runtime behavior is malicious: it exports middleware which, upon first invocation, launches a detached Node.js process running a script that performs an HTTP GET request to a mutable anonymous JSON host (https://jsonkeeper.com/b/EXSIF). It extracts a JavaScript payload from the response, dynamically compiles and executes it with full access to Node.js modules via the real require function. Additionally, it stores a base64-encoded fallback C2 endpoint and obfuscated header information to evade detection. This combination of impersonation, remote opaque payload execution, detached silent processes, and obfuscation constitutes clear supply-chain abuse, granting the attacker arbitrary code execution in the host environment.

References

npmjs.com/package/notify-logs/v/1.3.5 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 11 Jul 2026, 10:03 UTC

Technical details

References

Community reviews