malware npm

@thymelab/logfx

discovered 2026-06-23

Campaign member, masquerades as a logger utility. Version 2.15.5 ships a 282KB obfuscated payload (dist/bootstrap.js) auto-executed via postinstall 'node dist/bootstrap.js'. Same execution wrapper and payload template as the root lineage.

Threat types

credential_stealer data_exfiltration persistence typosquat

Malicious versions

2.15.5 · e0c0a4156bc957fd…

Campaigns

wshu.net npm Credential-Stealer Campaignattributed-to

Indicators

email [email protected]communicates-with
sha256 4e927f22ad04f4ac9b487ae11412fc2a55210188789ac29f3a47ad77931907a5indicates

Techniques

ttp T1059.007 Command and Scripting Interpreter: JavaScriptuses
ttp T1027 Obfuscated Files or Informationuses

Read the full analysis →