Malicious code in pretty-logger-utils (npm)
pretty-logger-utils is a malicious npm package that triggers malware behavior from a dependency (terminal-logger-utils) upon installation or import. The attack chain includes a postinstall hook that executes an obfuscated dropper, which downloads and runs a platform-specific second-stage binary from Hugging Face that provides keylogger, infostealer, and RAT capabilities.
- Disclosed
- Last updated
- Blast radius
- Potentially all systems that installed or imported pretty-logger-utils; secondary impact on systems running the downloaded second-stage payload.
- Ecosystems
- Attack vectors
- Affected entities
- pretty-logger-utilsMalicious npm package that depends on terminal-logger-utils
pretty-logger-utils is a malicious npm package discovered and documented by the OpenSSF. The package depends on terminal-logger-utils and activates malicious behavior from that dependency when installed or imported.
The attack chain begins with a postinstall hook that executes utils.cjs, an obfuscated malware dropper. This dropper downloads and executes a platform-specific second-stage binary hosted on Hugging Face.
The second-stage payload provides comprehensive malware functionality including keylogging, information stealing, and remote access trojan (RAT) capabilities. It exfiltrates sensitive local data including Telegram Desktop sessions, browser login databases, cryptocurrency wallets, SSH keys, cloud configurations, environment variables, and files matching specific keywords. The payload establishes a connection to a remote server for full machine control.
This incident was identified and credited to the OpenSSF's malicious-packages repository.
Indicators of compromise
- Packages
- pretty-logger-utils
- terminal-logger-utils
Remediation
- Immediately uninstall pretty-logger-utils and terminal-logger-utils from all affected systems
- Audit npm package.json and lock files for presence of pretty-logger-utils or terminal-logger-utils
- Regenerate all sensitive credentials including SSH keys, API tokens, and cloud authentication
- Reset passwords for all accounts accessed from affected systems, particularly email, cryptocurrency wallets, and cloud services
- Scan affected systems for malware and suspicious processes
- Review browser login databases and Telegram Desktop sessions for unauthorized access
- Monitor for unauthorized access to cloud configurations and environment variables
- Check for exfiltration of sensitive files from affected systems
Sources
- GitHub Advisory GHSA-jfcj-69ch-v65w · GitHub Advisory Database
Cite this entry
"Malicious code in pretty-logger-utils (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 27, 2026. https://supplychainattack.org/incident/malicious-code-in-pretty-logger-utils-npm-m29wn8
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in edu-npm-dependency-chain-demo
Malware discovered in the npm package edu-npm-dependency-chain-demo. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malware in roblox-api-client
Malware was discovered in the npm package roblox-api-client, resulting in full system compromise for any computer with the package installed or running. The advisory recommends immediate removal of the package and rotation of all secrets and keys from a different computer.
npmCompromised package - containedcritical
Malware in jextic-eclib
Malware was discovered in the npm package jextic-eclib, resulting in full system compromise of any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package - activecritical
Malware in @thone33/analytics-injector
Malware discovered in the npm package @thone33/analytics-injector. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package