NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
Malicious package

@pelmnaads/naads-common-loggernpm

Advisory published Updated

@pelmnaads/naads-common-logger is a confirmed malicious npm package (MAL-2026-3748) that executes malicious code on install (malicious version 19999.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in @pelmnaads/naads-common-logger (npm)

MAL-2026-3748
Immediate action
Remove the package, then rotate any secrets the build/runtime could reach.
npm uninstall @pelmnaads/naads-common-logger

What this malware does

The package is published to the public npm registry under @pelmnaads/naads-common-logger with version 19999.0.1 — the canonical dependency-confusion pattern, where an abnormally high version is used to make npm's resolver prefer this public package over a private internal package of the same name. On npm install, a preinstall lifecycle script (preinstall.js:5-9) makes an HTTPS GET to h5nvwrz2815ubw84cpkwhezm5db9z1nq.b.mburpcollab.com with query parameters package=<npm_package_name>&hostname=<os.hostname()>, transmitting the installer's hostname off-host to a Burp Collaborator out-of-band interaction endpoint. The README states this is an authorized security test, but the code path and effect on an unsuspecting installer are identical to a hostile dependency-confusion attack: build hosts silently disclose their identity to a third-party domain during npm install, with no opt-in. Any build system that resolves this package (e.g., an internal Pelmorex pipeline expecting the private @pelmnaads/naads-common-logger) would leak hostname data.

Malicious versions

1 flagged
19999.0.1

Indicators of compromise (SHA-256)

2f25d490deb5c32e9675f7941c54e8e9c9c1c180adaf00de19e4bb2a10325c47
68990dfacdc750bf464d646aca4855c2dd23bbefcadef1d9638e2d663a23fc57
8e4fd2828e3ff35aa485baef1b289b8faa19386e1c5199cbddb213b844a57733

Detection & response playbook

Malicious package

  1. Find it

    Search your lockfiles and build artifacts for @pelmnaads/naads-common-logger (version 19999.0.1).

  2. If you installed it — respond

    Remove @pelmnaads/naads-common-logger from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

  3. Did it already run?

    If @pelmnaads/naads-common-logger was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. @pelmnaads/naads-common-logger on npm has been identified as a malicious package (version 19999.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-002766IN-MAL-2026-002763IN-MAL-2026-002786

References

Credits

  • Amazon Inspector · finder

Detect & block this

O3 blocks @pelmnaads/naads-common-logger-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database
@pelmnaads/naads-common-logger (npm) malicious package — MAL-2026-3748 | O3 Security