OpenSSF/OSV advisory MAL-2026-4197 confirms this npm version as malicious. pretty-logger-utils is a malicious npm package that depends on terminal-logger-utils and triggers the malicious behavior in that package when installed or imported.
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in pretty-logger-utils (npm)
Details
pretty-logger-utils is a malicious npm package that depends on terminal-logger-utils and triggers the malicious behavior in that package when installed or imported.
The terminal-logger-utils payload executes a postinstall hook that opens utils.cjs, an obfuscated malware dropper. The dropper downloads and runs a platform-specific second-stage binary from Hugging Face. The second-stage payload provides keylogger, infostealer, and RAT behavior, steals sensitive local data including Telegram Desktop sessions, browser login databases, crypto wallets, SSH keys, cloud configurations, environment variables, and keyword-matched files, and connects to a remote server for full machine control.
Decision reason
OpenSSF Malicious Packages via OSV confirms pretty-logger-utils@1.0.0 as malicious (MAL-2026-4197): Malicious code in pretty-logger-utils (npm)