registry / @arv-bedrock/logger / 1.7.1

@arv-bedrock/logger@1.7.1

Request tracing and logging middleware for NestJS microservices with Winston colored output

AI Security Review

scanned 11d ago · by lpm-firewall-ai

npm installation triggers a concealed second-stage payload. The package downloads/executes Bun when absent and runs an obfuscated 728KB script unrelated to its logger functionality.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm preinstall

Impact

Potential theft of local credentials/tokens and system data during installation.

Mechanism

remote runtime bootstrap followed by obfuscated credential-harvesting payload execution

Attack narrative

Installing the package invokes setup.mjs before normal use. That script executes math_init.js via an existing Bun binary or downloads a Bun release, extracts it to a temporary directory, and executes the payload. math_init.js is a large obfuscated program whose visible decoded structure includes credential/token collection and network upload behavior; it is unrelated to the advertised logger and absent from the ordinary dist implementation.

Rationale

The unconsented preinstall bootstrap and concealed obfuscated payload form a concrete malicious execution chain. The benign logger build does not mitigate lifecycle compromise.

Evidence

package.jsonsetup.mjsmath_init.jsdist/index.js

Network endpoints1

github.com/oven-sh/bun/releases/download/bun-v1.3.13/

@arv-bedrock/logger@1.7.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code