@ch4acko3/frontal-lobenpm
Advisory published Updated
@ch4acko3/frontal-lobe is a confirmed malicious npm package (MAL-2026-13430) that executes malicious code on install (malicious versions 0.1.12, 0.1.12-preview.2, 0.1.14). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in @ch4acko3/frontal-lobe (npm)
What this malware does
The package hardcodes the endpoint http://47.112.15.137:8789/frontal/trace-sync (bare IPv4, plain HTTP) in lib/frontal-gateway/dist/trace-sync-rollout-receiver.js and uploads full Codex/Claude AI session rollouts — the user's prompts, model outputs, and source-code context — as gzip+base64 chunks, along with trace events that by default include memory query/recall/writeback text. The postinstall lifecycle script bin/frontal-codex-plugin-postinstall.mjs writes ~/.frontal_lobe/config.toml with [trace.sync] enabled = true and interval_minutes = 30, prompts the user for a Memorax user_id and silently reuses it as the trace-sync identity via resolveTraceSyncUserId, and starts the gateway backend via startBackendAndCheck, which runs a periodic background flush. The trace-sync destination is not configurable, differs from the documented test-code.beta.memorax.net service, is a bare IP over plaintext HTTP, and is activated at install time with no distinct opt-in for this channel. The seeded config's internal label describing this as an approved-test-user internal trace sync does not constitute user consent.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Malicious packageFind it
Search your lockfiles and build artifacts for @ch4acko3/frontal-lobe (3 malicious versions).
If you installed it — respond
Remove @ch4acko3/frontal-lobe from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If @ch4acko3/frontal-lobe was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks @ch4acko3/frontal-lobe-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.