MAL-2026-6338

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/log-taker/MAL-2026-6338.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6338
Published
2026-06-23T20:20:56Z
Modified
2026-06-23T21:01:22.674824895Z
Summary
Malicious code in log-taker (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (35623f56ea43d8a9a7ac1caa84678ed40d6923fdf19d8d23f7d4aacdde1a8c4a)

index.js requires child_process and invokes execSync with bash and zsh shells (around lines 315 and 331). The available evidence does not establish what commands are run, whether the calls fire at install/import time or only when a caller invokes a specific exported function, or whether any installer data is exfiltrated to a network destination. The package name suggests a log-collection tool, which can legitimately shell out to system utilities, but the shell-execution surface combined with the absence of clear scoping warrants human review of the actual command strings and reachability before recommending the package to installers.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-06-23T20:48:31.205519585Z",
            "modified_time": "2026-06-23T20:20:56Z",
            "sha256": "35623f56ea43d8a9a7ac1caa84678ed40d6923fdf19d8d23f7d4aacdde1a8c4a",
            "versions": [
                "0.1.0"
            ],
            "id": "IN-MAL-2026-007361",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / log-taker

Package

Name
log-taker
View open source insights on deps.dev
Purl
pkg:npm/log-taker

Affected ranges

Affected versions

0.*
0.1.0

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "f382985e25fb213281e373e4554f10167679d443360ade49778c87982fae928a2f2fec",
            "sha256": "67490d46bcfdd64cec9b8c94cdb7a674ba6bb95e38e0db951fbfecc58849bdbd",
            "path": "index.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "log-taker-0.1.0.tgz",
            "hashes": {
                "sha1": "892ac6b456f5dd6c9c2c63e767841a4a194d9ed8",
                "sha512_sri": "sha512-KQ5AjqIQxRxfHI2RLI0yLw9jTwPxt7RBG0NKdLTDhcg9jwfLr7rKSUyCN1NOOQjYlUbtb1BC60C92/ntwP+AFA=="
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/log-taker/MAL-2026-6338.json"