Which versions of notifier-log are malicious?

The following npm versions of notifier-log are flagged malicious: 1.3.5. Treat any of these as compromised.

How do I remediate notifier-log if I installed it?

Remove notifier-log from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed notifier-log — how do I know if it already compromised me?

If notifier-log was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is notifier-log part of a known attack campaign?

Yes — notifier-log is associated with the IN-MAL-2026-009649 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find notifier-log across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for notifier-log (version 1.3.5). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging notifier-log across your stack and pipelines.

Malicious package

notifier-lognpm

Malicious code in notifier-log (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-10153

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall notifier-log

What this malware does

The package presents itself as a pino-compatible logger (main entry exports a middleware aliased as pino, and lib/ contains pino-shaped files such as proto.js, redaction.js, multistream.js, transport.js), but its middleware spawns a detached child process running lib/caller.js which fetches a JSON blob from a hardcoded jsonkeeper.com paste, extracts a .cookie string, and passes it to new Function.constructor('require', s)(require). This executes attacker-controlled JavaScript with full require access under the installer's Node process. A base64-encoded backup endpoint and secret header key are stored in lib/const.js (decoding to a second jsonkeeper.com paste URL with an x-secret-key header), providing a redundant delivery channel. Because jsonkeeper.com is a mutable public paste site, the served payload can be changed at any moment. The logger API is a cover story for the dropper.

Malicious versions

1 flagged

1.3.5

Indicators of compromise (SHA-256)

f4c2346bef8105dc24079ee47eb8cd65dbb92f7dbbd6d17ac0c576646878298c

Detection & response playbook

Malicious package

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for notifier-log (version 1.3.5). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging notifier-log across your stack and pipelines.
If you installed it — respond
Remove notifier-log from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If notifier-log was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks notifier-log before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. notifier-log on npm has been identified as a malicious package (version 1.3.5 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-009649

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks notifier-log-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring