Threats Tagged 'mal-2026-10225'

The @logdna-web/shared npm package is a malicious package published as part of a dependency confusion campaign. It uses a preinstall hook to execute code that collects and sends host telemetry, including public IP and personally identifiable information (PII), to an attacker-controlled Sentry endpoint. The package name mimics a legitimate internal package namespace to trick misconfigured resolvers into installing it. The malicious payload also silently relays application exceptions and PII to the attacker if the package's init function is called without a custom DSN. This package version 13.19.37 is affected. The package should be considered fully compromised if installed, and all secrets on the host should be rotated immediately.