MAL-2026-7314

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/logfuse/MAL-2026-7314.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-7314
Aliases
  • GHSA-qxfw-2vwr-x4mp
Published
2026-07-07T12:57:52Z
Modified
2026-09-01T11:31:33Z
Summary
Malicious code in logfuse (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (259fc8b205e41dea32af006c7eaa325f0d1cca2421c668b778b8d2559d8ec900)

The package was found to contain malicious code or consuming dependency that contains malicious code

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "RLMA-2026-05145",
            "import_time": "2026-07-09T09:16:37.47455641Z",
            "modified_time": "2026-07-07T12:57:52Z",
            "sha256": "389e75ed90c0c82ffc717d29b97dd7b368dc458cdfa0005440be404baef1c971",
            "source": "reversing-labs",
            "versions": [
                "2.1.6"
            ]
        },
        {
            "id": "IN-MAL-2026-009409",
            "import_time": "2026-07-09T22:02:28.375640612Z",
            "modified_time": "2026-07-09T21:51:42Z",
            "sha256": "259fc8b205e41dea32af006c7eaa325f0d1cca2421c668b778b8d2559d8ec900",
            "source": "amazon-inspector",
            "versions": [
                "2.1.6"
            ]
        },
        {
            "id": "RLUA-2026-06312",
            "import_time": "2026-09-01T11:18:11.443143925Z",
            "modified_time": "2026-08-24T16:58:00Z",
            "sha256": "3d08b2e7fe62e81b7f3d100414dac694f05ad40ab5db36641a52c56d13f4d05f",
            "source": "reversing-labs"
        }
    ]
}
References
Credits

Affected packages

npm / logfuse

Package

Name
logfuse
View open source insights on deps.dev
Purl
pkg:npm/logfuse

Affected ranges

Affected versions

2.*
2.1.6

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "logfuse-2.1.6.tgz",
            "hashes": {
                "sha1": "21a87867a46990d32eaa4ac3e15da5ef03a843f7",
                "sha512_sri": "sha512-E1wgtNiNzkM4RuXbanyYHeqj5wRt+ucOvh04rfFXg/OzEfnSuE1XSQAU/sac5I/bdvzfcuRgESQmDlZCScZ4aA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/logfuse/MAL-2026-7314.json"