MAL-2026-14292

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/log-res/MAL-2026-14292.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14292
Published
2026-08-19T08:23:09Z
Modified
2026-08-19T09:00:19.386661003Z
Summary
Malicious code in log-res (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (59f23ea1c6c40021fb69210eba68cdbda94b42f4e255f78758778b90ebb09d78)

index.js re-exports a desKey string sourced from apps/docs/app/theta.js, which reads apps/docs/app/des.db as UTF-8. des.db contains a heavily obfuscated JavaScript program (string-array + hex-name mangling) that, when evaluated, creates a directory under the OS temp directory, writes a synthetic package.json declaring runtime dependencies on axios, better-sqlite3, node-machine-id, and socket.io-client, spawns npm install inside that directory, and then spawns node on a staged index.js. The payload is disguised as a database file (des.db) rather than shipped as source, and the stager fetches and runs a socket.io-client-based remote agent capable of receiving commands from an attacker-controlled endpoint. The package's advertised purpose (a docs/monorepo TheData API helper) does not require embedding or exporting an obfuscated executable blob.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T08:48:53.617406895Z",
            "sha256": "59f23ea1c6c40021fb69210eba68cdbda94b42f4e255f78758778b90ebb09d78",
            "modified_time": "2026-08-19T08:23:09Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018407",
            "versions": [
                "1.0.3"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / log-res

Package

Name
log-res
View open source insights on deps.dev
Purl
pkg:npm/log-res

Affected ranges

Affected versions

1.*
1.0.3

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/log-res/MAL-2026-14292.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "248e883a193f21ac7d1eb48fa7541513fbc381620d03957e7e70c8fa359d0984",
            "path": "apps/docs/app/theta.js",
            "tlsh": "cfd022c20c0f03888ee15b98950e60620bb300083b80d6a1f47d8f30302b488f55a29c"
        },
        {
            "sha256": "969e68faa42267ab57e154d6032b4009272b04ac76f28672dc97ecc1fa7585ba",
            "path": "apps/docs/app/des.db",
            "tlsh": "c2f2c8cc3f81f3e46213b0bb6e1aa4d5e1699cd8bd8d8048f356b458f958324e1bdb19"
        }
    ],
    "package_integrity": [
        {
            "filename": "log-res-1.0.3.tgz",
            "hashes": {
                "sha512_sri": "sha512-VYZZkum8ubdiwhuGhTeSBO2ZoIhbQGY1f6YiQHVMCKMJ70wPCA1LwsmiBgZG/FB6IvB9rAsdvPpxJQ1+R11e9A==",
                "sha1": "d265c04001e0ec8f495dd630c13dabacd0b810c0"
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]