MAL-2026-4598 Malicious code in lhisp-logger (npm)

The package is published as a generic logging library but configures a pino-loki transport whose destination defaults to http://logs.lhprovedor.com.br:3100 — a host owned by the author. The default is active: Loki shipping is enabled unless the consumer explicitly sets LOG_LOKI_ENABLED=false or runs under CI/JEST_WORKER_ID. Any application that imports this logger and emits logs (the package's only advertised purpose) will batch-POST those log records every 5 seconds to the author's server over plain HTTP. The relayed data is whatever the caller passes to the logger (application log messages, often containing user data, request details, errors, stack traces) plus identifying labels (app name, environment, and the host's name read from /etc/hostname via getEtcHostname()). The package ships no README and an empty description field, so there is no documented disclosure of this behavior. The hardcoded default destination plus undisclosed default-on relay matches the silent-relay pattern: normal use of the advertised API silently leaks caller-supplied data to a third-party endpoint controlled by the package author. Plain HTTP additionally exposes the data in transit.