Malicious code in external-process-live-log (npm)
The npm package external-process-live-log contains malicious code that fetches and executes arbitrary JavaScript from a hardcoded IP endpoint (31.97.137.157:45000) with full Node.js context on the consumer's host. The package is disguised as a process logger but includes unused dependencies for credential access and misleading metadata.
- Disclosed
- Last updated
- Blast radius
- All consumers of the external-process-live-log npm package
- Ecosystems
- Attack vectors
- Affected entities
- external-process-live-lognpm package with malicious code in default export
The npm package external-process-live-log was found to contain malicious code in its default export. When loaded, the package issues an HTTPS request to a hardcoded bare-IP endpoint (https://31.97.137.157:45000/icons/107) with a 'bearrtoken: logo' header, using a font-awesome-styled path as cover for the request.\n\nThe response from this endpoint contains a credits field that is passed directly into a JavaScript Function constructor (new Function('require','module',...,'Promise', data.credits)), allowing the attacker to execute arbitrary code with full Node.js context on the consumer's machine.\n\nThe package is deceptively labeled as a simple process logger in its README, but package.json describes it as a 'TypeScript SDK for the Polymarket CLOB API' and declares unused dependencies associated with credential access on Windows (@primno/dpapi, node-machine-id, better-sqlite3, socket.io-client). A setDefaultModule helper fabricates a plausible CDN-style URL string that serves as cover for the actual bare-IP fetch.\n\nThe incident was identified by the OpenSSF malicious-packages project and published via GitHub Security Advisory GHSA-5q78-2f9h-xv69.
Indicators of compromise
- Packages
- external-process-live-log
- IPs
- 31.97.137.157
Remediation
- Immediately uninstall external-process-live-log from all environments
- Audit npm package.json and lock files for any installations of external-process-live-log
- Review system logs and network traffic for connections to 31.97.137.157:45000 to detect if the malicious code was executed
- Rotate any credentials or secrets that may have been exposed on affected systems
- Update to a safe alternative package for process logging functionality
- Implement npm package scanning and verification in your CI/CD pipeline to detect malicious packages
Sources
- GitHub Advisory GHSA-5q78-2f9h-xv69 · GitHub Advisory Database
Cite this entry
"Malicious code in external-process-live-log (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malicious-code-in-external-process-live-log-npm-1atv5h
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in reseller-app
Malware discovered in the npm package reseller-app. Any computer with this package installed or running should be considered fully compromised. All secrets and keys must be rotated immediately from a different computer.
npmCompromised package - containedcritical
Malware in bnpl-blocks-independent-bnpl-search
The npm package bnpl-blocks-independent-bnpl-search contained malware that provided full system compromise to attackers. Any computer with this package installed should be considered fully compromised.
npmCompromised package - activecritical
Malware in @zynkit/probe
Malware discovered in the npm package @zynkit/probe. Systems with this package installed or running are considered fully compromised, with potential for complete system takeover.
npmCompromised package - activecritical
Malware in club-sauce
Malware discovered in the npm package club-sauce. Any computer with this package installed or running should be considered fully compromised. All secrets and keys must be rotated immediately from a different computer.
npmCompromised package