Which versions of @thymelab/logfx are malicious?

The following npm versions of @thymelab/logfx are flagged malicious: 2.15.3, 2.15.4, 2.15.5, 2.15.6. Treat any of these as compromised.

How do I remediate @thymelab/logfx if I installed it?

@thymelab/logfx is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed @thymelab/logfx — how do I know if it already compromised me?

If @thymelab/logfx was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is @thymelab/logfx part of a known attack campaign?

Yes — @thymelab/logfx is associated with the IN-MAL-2026-007289, IN-MAL-2026-007296, IN-MAL-2026-007290, IN-MAL-2026-007291 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find @thymelab/logfx across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @thymelab/logfx (4 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @thymelab/logfx across your stack and pipelines.

Malicious package

@thymelab/logfxnpm

Malicious code in @thymelab/logfx (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-6311

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall @thymelab/logfx

What this malware does

@thymelab/logfx (malicious version 2.15.5, published by [email protected]) is a trojanized npm package belonging to the wshu.net credential-stealer campaign. The campaign published trojanized look-alike utility packages across 12+ scopes whose publisher accounts all follow the pattern <scope>-<6 random chars>@wshu.net, with every scope created on June 4, 2026 in a ~40-minute burst. This package masquerades as a logger and ships real, working utility code so it passes a glance, while bundling a much larger malicious payload at dist/bootstrap.js. package.json declares a postinstall hook ("node dist/bootstrap.js") that runs the payload automatically on npm install. The payload is heavily obfuscated with javascript-obfuscator (hex-named identifiers, a while (!![]) array-rotation IIFE, base64+RC4 string decoding, control-flow flattening, and runtime-decrypted module resolution to stay out of the static module graph). At runtime it is a Chromium browser credential stealer: it reads Chromium Cookies and Login Data and decrypts saved passwords protected by AES-256-GCM (the v10/v11 app-bound key schemes), then exfiltrates them over HTTPS using a spoofed Mozilla/5.0 user agent. Malicious payload dist/bootstrap.js SHA-256: 4e927f22ad04f4ac9b487ae11412fc2a55210188789ac29f3a47ad77931907a5.

@thymelab/[email protected] ships a postinstall hook (postinstall: node dist/bootstrap.js) that runs a 282KB obfuscator.io-packed script on every npm install. The decoded control flow performs HTTPS GETs to a runtime-decrypted URL, AES-256-GCM-decrypts the response using an embedded key, sha256-verifies, stages files into os.tmpdir(), chmod's them, and re-spawns them via process.execPath using child_process.spawn with detached/unref'd handles. The script disables itself when --inspect/--debug are present (anti-analysis). The destination URL and decryption key are not pinned plaintext — they are decrypted at runtime, giving the publisher a mutable, attacker-controlled execution channel into every installer. Independently, dist/logfx.js is a near-verbatim copy of the unjs/consola logger and package.json.repository/bugs.url falsely point to github.com/unjs/consola, impersonating that project; an appended IIFE wraps the exported withTag API to call require('./bootstrap').runPrepare(), so the dropper also detonates when a consumer simply imports the package and uses its documented API. The combination of opaque obfuscation, runtime-decrypted remote URL, tmpdir staging with execPath respawn, anti-debug guard, and import-time trigger is a hostile install-time dropper, not a logging utility.

Malicious versions

4 flagged

2.15.32.15.42.15.52.15.6

Indicators of compromise (SHA-256)

3c57907e48ed3dede63346844e2df299a60821c677e0b1821fdbdd2ac2702e7e

d217a8cca41219fe27785abb745c50575b1d0de4203060c6ca533adf19316ce5

edce595ab99f7bcc5404f8c1222a1d8f5a7cbbb1fc6cd6e02aabddaf19526839

6f08decce4aef5ebdd1c8e3dd2e68574440b1a0d1d4917e9ab1a893cd7c9ef35

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @thymelab/logfx (4 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @thymelab/logfx across your stack and pipelines.
If you installed it — respond
@thymelab/logfx is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If @thymelab/logfx was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks @thymelab/logfx before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. @thymelab/logfx on npm has been identified as a malicious package (versions 2.15.3, 2.15.4, 2.15.5, 2.15.6 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-007289IN-MAL-2026-007296IN-MAL-2026-007290IN-MAL-2026-007291

References

Credits

Amazon Inspector · finder
SafeDep · finder

Detect & block this

O3 blocks @thymelab/logfx-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring