js-logger-pack

discovered 2026-04-15

js-logger-pack is a malicious npm package (29 versions, 2026-04-01 to 2026-04-20) that evolved from an SSH backdoor and infostealer into a binary dropper for MicrosoftSystem64, an 81 MB Node.js SEA RAT with 24 remote tasks covering browser credential theft (15 families), 80+ crypto wallet extensions, keylogging, clipboard monitoring, screenshot capture to HuggingFace, Telegram session hijack, SSH key exfiltration, and remote shell access. Attributed to DPRK Famous Chollima / Contagious Interview via jpeek868 account linkage. OSV: MAL-2026-2827 / GHSA-mj89-jrhm-qxhc.

Threat types

credential stealer
crypto drainer
data exfiltration
persistence
c2 agent
rat

Malicious versions

0.0.1
1.0.0
1.1.0
1.1.2
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.1.10
1.1.14
1.1.17
1.1.18
1.1.19
1.1.20
1.1.21
1.1.22
1.1.23
1.1.24
1.1.25
1.1.26

Campaigns

Contagious Interviewattributed-to

Indicators

Techniques

Read the full analysis

APIThreat Intel Feed API · Confirmed malicious packages, campaigns and IOCs, piped into your stackExplore the API