MAL-2026-7017

The npm package logger-daemon-regex is a full-spectrum information stealer and remote-control agent disguised as a "Node.js integration layer for Autodesk Forge" (all bin names are forge-*).

A postinstall lifecycle hook chains five scripts (postinstall-clipboard-event, ensure-dist, postinstall-durable-materialize, postinstall-bootstrap, postinstall-agent) that stand up a persistent background agent (via pm2 / an autostart CLI) on npm install, before the package is ever imported.

The agent scans the filesystem for a curated crypto-focused target list (shipped as secret_filename_patterns.json): wallet files (wallet.dat, .wallet, keypair.json, new_keypair.json), seed phrases (.mnemonic, .seed, .phrase), key material (.pk/p8/p12/pfx/jks/keystore, UTC-- Ethereum keystores, id.json Solana keypairs), and general secrets (.env*, secrets.json, keys.txt) across chain directories (.solana, .ethereum, .bitcoin, .web3, .keystore). It also harvests browser-extension databases, captures keyboard input and the clipboard, takes periodic screenshots, and exposes a remote file explorer / control channel (relayServer/relayAgent/fsProtocol). Crypto-seed dependencies @scure/bip39 and tweetnacl corroborate the wallet-theft intent.

Harvested data is archived and exfiltrated via Hugging Face Hub uploads (@huggingface/hub, using an hf_ token) and Discord webhooks.

Detected and classified independently by codelake Research from the live npm feed; at the time of reporting it was not present in OSV or GHSA (a first-catch). The package was unpublished from npm on 2026-07-01, hours after publication; the artifact is preserved in the codelake archive.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (867d520b17da5e885d1a1e1e954cbf9eaf045b55a28307319f4fbad27846b8a9)

package.json advertises the package as a 'Node.js integration layer for Autodesk Forge' but the shipped code is a full information-stealer / remote-access implant. On npm install, scripts.postinstall chains scripts/postinstall-agent.mjs, which (a) copies dist/ into a hidden per-user runtime prefix at <userdata>/.logger-daemon-regex/runtime/v<version>/ so the agent survives npm uninstall, (b) registers OS autostart against that hidden copy via cli-autostart.js, and (c) spawns a detached, windowsHide, unref'd node process running dist/cli-agent.js. The agent opens a WebSocket to a C2 host whose address is not present as plaintext: dist/deploymentDefaults.js reconstructs a 32-byte AES-256-GCM key by XOR-ing two obfuscated Uint8Array halves (DEPLOYMENTKEYA^DEPLOYMENTMASKA, DEPLOYMENTKEYB^DEPLOYMENTMASKB) and decrypts DEPLOYMENTCIPHERTEXTB64 (with IV/TAG) into publicHost / relayPort / apiPort / defaultExplorerPassword, from which ws://<host>:<port> is derived at runtime. Once connected, the agent runs dist/secretScan/agentStartupAudit.js, which walks POSIX '/' or every Windows drive and matches files by name and content against rules in dist/secretScan/contentScanner.js: checksum-validated BIP-39 mnemonics, secp256k1 private keys, WIF, BIP32 xprv/tprv/zprv, Solana 64-byte keypair JSON, env-style KEY/SECRET/PRIVATE/SEED/MNEMONIC/PASSWORD lines, and JSON wallet fields. Matches (with full secret material by default) are packaged into agents/<hostname>/result.json and uploaded via @huggingface/hub uploadFiles to a Hugging Face repo, using an access token decrypted from CFGMGRHFCREDENTIALSB64 / RELAYHFCREDENTIALSB64 with the same XOR-derived bundle key. dist/shellHistoryScan.js separately enumerates ~/.bashhistory, ~/.zshhistory, ~/.pythonhistory, ~/.nodereplhistory, ~/.mysqlhistory, ~/.psqlhistory, ~/.sqlitehistory, ~/.lesshst, fish history, Windows PowerShell PSReadLine ConsoleHosthistory.txt, Clink history, and Cygwin/msys homes, streaming records through syncClient to the same C2 relay. dist/hostInventorySend.js unconditionally POSTs hostname + os.type/platform/release/version + Node version to the same relay. dist/chromiumExtensionDbHarvest.js + dist/extensionDbHfUpload.js target Chromium/Chrome/Edge extension LevelDB stores (browser wallets, session cookies) and are enabled by default via FORGEJSAGENTEXTENSIONDBHFUPLOAD='1' set in postinstall-agent.mjs's turnkeySpawnEnvOverrides. dist/index.js additionally re-exports relayAgent, windowsInputSync, clipboardEventWatcher, discordRelayUpload, and workerBootstrap, giving the C2 operator keyboard/clipboard capture, screenshot exfiltration (handleDiscordScreenshotUploadFromAgent), and arbitrary file upload. The near-duplicate bin entries (forge-jsx-explorer-, forge-jsy-explorer-, logger-daemon-regex-explorer-kill-agent) and CFGMGR_* / FORGEJS* env-var namespaces reinforce the Autodesk Forge / cfgmgr impersonation cover story.