Malicious code in log-res (npm)

The npm package log-res was found to contain malicious code embedded in its source. The package's index.js re-exports a desKey string that references an obfuscated JavaScript program stored in a file named des.db, disguised as a database rather than executable code.\n\nWhen evaluated, the obfuscated payload creates a temporary directory, writes a synthetic package.json with dependencies on axios, better-sqlite3, node-machine-id, and socket.io-client, and executes npm install followed by node on a staged index.js file. This establishes a socket.io-client-based remote agent that connects to an attacker-controlled endpoint and awaits commands.\n\nThe package's stated purpose (a docs/monorepo TheData API helper) has no legitimate need for embedding or exporting such an executable blob, indicating intentional malicious inclusion. The incident was identified and credited to the OpenSSF's malicious-packages repository.