Which versions of notifier-log are malicious?

The following npm versions of notifier-log are flagged malicious: 1.3.5. Treat any of these as compromised.

How do I remediate notifier-log if I installed it?

Remove notifier-log from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed notifier-log — how do I know if it already compromised me?

If notifier-log was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is notifier-log part of a known attack campaign?

Yes — notifier-log is associated with the IN-MAL-2026-009649 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find notifier-log across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for notifier-log (version 1.3.5).

Malicious package

notifier-lognpm

Advisory published Jul 10, 2026Updated Jul 10, 2026

notifier-log is a confirmed malicious npm package (MAL-2026-10153) that executes malicious code on install (malicious version 1.3.5). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in notifier-log (npm)

MAL-2026-10153

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall notifier-log

What this malware does

The package presents itself as a pino-compatible logger (main entry exports a middleware aliased as pino, and lib/ contains pino-shaped files such as proto.js, redaction.js, multistream.js, transport.js), but its middleware spawns a detached child process running lib/caller.js which fetches a JSON blob from a hardcoded jsonkeeper.com paste, extracts a .cookie string, and passes it to new Function.constructor('require', s)(require). This executes attacker-controlled JavaScript with full require access under the installer's Node process. A base64-encoded backup endpoint and secret header key are stored in lib/const.js (decoding to a second jsonkeeper.com paste URL with an x-secret-key header), providing a redundant delivery channel. Because jsonkeeper.com is a mutable public paste site, the served payload can be changed at any moment. The logger API is a cover story for the dropper.

Malicious versions

1 flagged

1.3.5

Indicators of compromise (SHA-256)

f4c2346bef8105dc24079ee47eb8cd65dbb92f7dbbd6d17ac0c576646878298c

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for notifier-log (version 1.3.5).
If you installed it — respond
Remove notifier-log from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If notifier-log was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. notifier-log on npm has been identified as a malicious package (version 1.3.5 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-009649

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks notifier-log-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database