MAL-2026-16054

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/gloggo/MAL-2026-16054.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16054
Published
2026-09-09T00:16:27Z
Modified
2026-09-09T01:00:04Z
Summary
Malicious code in gloggo (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a333f8ded17af0754357d938933ee95e9ab1f857cc875948d49cb9b26992e75d)

gloggo impersonates the legitimate gulpjs 'glogg' logging library by copying its README, shields, and LICENSE text (attributed to Blaine Bublitz), while package.json attributes authorship to 'Blockvora Team team@blockvora.com' with repository 'blockvora/gloggo'. The package name is a one-character variant of 'glogg'. getLogger() invokes isSign('favorite','gloggo',12467) from the dependency 'file-type-detector' and, when that gate returns truthy, executes require('./log'). The './log' module is not present in the tarball, so its bytes must be produced or supplied at require time by the dependency. A logging utility has no legitimate reason to gate its loader on an opaque file-signature check from an unrelated third-party dependency, and the gated path executes code that is not part of the shipped package contents. Consumers who install gloggo believing it to be glogg import a typosquat that conditionally runs code sourced from a suspicious sibling dependency when the module is required.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019727",
            "import_time": "2026-09-09T00:47:57.934844705Z",
            "modified_time": "2026-09-09T00:16:34Z",
            "sha256": "4b6a7344a560f0fa4e00d334efef568cd34c3800101315a95f647dabc8285fb1",
            "source": "amazon-inspector",
            "versions": [
                "1.1.3"
            ]
        },
        {
            "id": "IN-MAL-2026-019726",
            "import_time": "2026-09-09T00:47:57.874027179Z",
            "modified_time": "2026-09-09T00:16:27Z",
            "sha256": "6bacf73012ce6ed828bddaf332d26ae8289b5585ea886cfc85852ac0d647282e",
            "source": "amazon-inspector",
            "versions": [
                "1.1.4"
            ]
        },
        {
            "id": "IN-MAL-2026-019728",
            "import_time": "2026-09-09T00:47:58.012084713Z",
            "modified_time": "2026-09-09T00:16:41Z",
            "sha256": "a333f8ded17af0754357d938933ee95e9ab1f857cc875948d49cb9b26992e75d",
            "source": "amazon-inspector",
            "versions": [
                "1.1.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / gloggo

Package

Name
gloggo
View open source insights on deps.dev
Purl
pkg:npm/gloggo

Affected ranges

Affected versions

1.*
1.1.2
1.1.3
1.1.4

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "244f714c904187298d10bbef8a6df888097f7090aa8949f8c87b836549e333bd",
            "tlsh": "8c21ee765af6b1536d3b74a5960e670235b9c0d7401ceb4139ece3812f68c380b76bd8"
        },
        {
            "path": "package.json",
            "sha256": "74aeaf049db1e557f320a380b3d7a78ab3dee9b13cafde57a04e6241290b3814",
            "tlsh": "3b110611ce789ca342d8a2ae781e02c265755d9348c9fd0cb79a530c0f5e52f64fd5ac"
        }
    ],
    "package_integrity": [
        {
            "filename": "gloggo-1.1.3.tgz",
            "hashes": {
                "sha1": "28199903616edb2524c2e305f055bced94a2f791",
                "sha512_sri": "sha512-bgoTi37QcXFMtf6kmmq8SOJNPONIFVc1QJw2HiVG5A4l7zxBsoJ8zM2yKdML4tBZ/gnZFjNBhyCSyRPU25xRBg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/gloggo/MAL-2026-16054.json"