Homepage

@thymelab/logfx@2.15.4

Elegant console logger for Node.js — levels, tags, pluggable reporters, with a browser bundle for SSR/SPA symmetry

  • latest version

    2.15.6

  • first published

    1 months ago

  • latest version published

    26 days ago

  • licenses detected

  • View logfx package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @thymelab/logfx package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • C
    Malicious Package

    @thymelab/logfx is a malicious package. This package contains malicious code and is part of a coordinated npm supply-chain campaign. It ships an obfuscated postinstall payload that downloads and executes a Rust-compiled infostealer binary.

    Impact

    The infostealer targets crypto wallets, browser credentials, cloud tokens, SSH keys, and developer credentials (npm, .env, GitHub/PyPI tokens). It installs persistence via a disguised systemd service and exfiltrates data over Telegram or HTTP. Some versions trigger at runtime, allowing the payload to survive --ignore-scripts.

    Note

    1. This package is part of a larger campaign, involving many packages published from disposable @wshu.net accounts.

    2. This actor has also been linked to attempts to compromise AI-powered workflows.

    3. Malicious versions were hidden behind scrubbed latest tags, so treat all versions as untrusted.

    How to fix Malicious Package?

    Avoid using all malicious instances of the @thymelab/logfx package.

    =2.15.3=2.15.4=2.15.5=2.15.6
    Go back to all versions of this package