{"answers":{"affected":"1 open source package ship an affected version, including @ferudionz/web_logger_js.","exploited":"There is no known exploitation of MAL-2026-14044 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-14044 is a malicious package in @ferudionz/web_logger_js, published on 14 Aug 2026."},"fix_prompt":"MAL-2026-14044 is a malicious package: @ferudionz/web_logger_js (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-14044/ (Markdown: https://insights.sbomify.com/MAL-2026-14044/index.md)","id":"MAL-2026-14044","markdown":"https://insights.sbomify.com/MAL-2026-14044/index.md","name":"MAL-2026-14044","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The package ships a single obfuscator.io-style `index.js` with a rotated string array, RC4 key-schedule + XOR string decoder, self-defending anti-debug wrapper, and per-call proxy functions. All identifiers (the `require` target, the HTTP method name, and the destination URL) are reconstructed at runtime from ~130 encoded literals, hiding the actual network destination from static inspection. The sole exported function `connet(x)` unconditionally issues `axios.get(API_BASE_URL + x)` where `API_BASE_URL` is a URL assembled at runtime from ~13 RC4-decoded fragments. Any consumer that calls the package's public API sends its argument to a hardcoded author-controlled destination the caller did not configure. The README hint (`npm install evm_account`) and the name mismatch between the published package and its documented install string are consistent with an EVM/crypto-account-targeted exfiltration helper: a caller passing an account identifier, address, key material, or similar input to `connet()` will silently leak it to the obfuscated endpoint. The concealment of the destination behind RC4 decoding and anti-debug wrapping rules out an inadvertent, documented service call.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in @ferudionz/web_logger_js (npm)","id":"MAL-2026-14044","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"@ferudionz/web_logger_js","purl":"pkg:npm/%40ferudionz/web_logger_js","source":"MAL-2026-14044"}],"products":null,"published":"2026-08-14","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-14044/"}