OpenSSF/OSV advisory MAL-2026-3771 confirms this npm version as malicious. request-logger-canary@1.0.0 ships a preinstall.js that, when `npm install` runs, opens a TCP socket to 52.74.242.200:8851 and pipes an interactive `/bin/sh` to the remote endpoint (stdin/stdout/stderr all bridged to the socket). The code executes unconditionally at install time via scripts.preinstall — there is no guard, no `if (false)`, no environment check...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in request-logger-canary (npm)
Details
request-logger-canary@1.0.0 ships a preinstall.js that, when `npm install` runs, opens a TCP socket to 52.74.242.200:8851 and pipes an interactive `/bin/sh` to the remote endpoint (stdin/stdout/stderr all bridged to the socket). The code executes unconditionally at install time via scripts.preinstall — there is no guard, no `if (false)`, no environment check. The README falsely claims the reverse shell is dead code wrapped in `if (false)` and located in postinstall.js; the live payload is actually in preinstall.js with no guard. This misdirection is itself evidence of deliberate supply-chain attack intent. Any machine running `npm install request-logger-canary` hands a root-of-user interactive shell to the operator of 52.74.242.200.
Decision reason
OpenSSF Malicious Packages via OSV confirms request-logger-canary@1.0.0 as malicious (MAL-2026-3771): Malicious code in request-logger-canary (npm)