MAL-2026-15991 Malicious code in jwt-logger (npm)

The package is published as a trivial JWT logging helper but its main module (jwt-logger.js) is a heavily obfuscated string-array dropper. On require(), it creates a hidden directory under os.homedir()+'/.cache', writes an obfuscated second-stage JavaScript payload plus a synthetic package.json declaring runtime dependencies (axios, better-sqlite3, node-machine-id, socket.io-client, with ffi-napi/koffi on Windows), and spawns node (process.execPath) on that payload with {detached:true, stdio:'ignore'} and unref(), so the second stage keeps running after the parent exits. On Windows it resolves %WINDIR%\System32\wscript.exe to launch a.vbs form of the payload, or falls back to cmd.exe /d /s /c with windowsVerbatimArguments to run without a visible console. All runtime strings are hidden behind an obfuscator.io-style rotated string array with a base64/URL decoder. package.json attributes authorship to 'Blake Embrey' <[email protected]> and the README carries blakeembrey.com/travis/coveralls badges, none of which corresponds to the shipped code. package.json additionally lists 'jwt-logger':'^2.3.7' as a dependency of itself (this artifact is 2.1.9), pulling an unpinned newer publisher-controlled version into every installer at install time. The socket.io-client dependency and detached background node process are consistent with a C2-controlled second stage.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.