Which versions of overstock-logger are malicious?

The following npm versions of overstock-logger are flagged malicious: 0.0.1-security, 3.8.2, 3.9.3, 3.9.4, 3.10.0, 3.11.3, 3.12.3, 3.13.3, 3.14.4, 3.16.4, 3.17.4, 59.2.12. Treat any of these as compromised.

How do I remediate overstock-logger if I installed it?

Remove overstock-logger from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed overstock-logger — how do I know if it already compromised me?

If overstock-logger was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is overstock-logger part of a known attack campaign?

Yes — overstock-logger is associated with the RLMA-2024-01525, RLUA-2024-07048, GHSA-2pfg-gwg8-4mvq, RLUA-2026-01474 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find overstock-logger across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for overstock-logger (12 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging overstock-logger across your stack and pipelines.

Malicious package

overstock-loggernpm

overstock-logger is a confirmed malicious npm package (MAL-2024-2814) that executes malicious code on install (malicious versions 0.0.1-security, 3.8.2, 3.9.3…). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in overstock-logger (npm)

MAL-2024-2814

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall overstock-logger

What this malware does

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The OpenSSF Package Analysis project identified 'overstock-logger' @ 3.12.3 (npm) as malicious.

It is considered malicious because:

The package communicates with a domain associated with malicious activity.
The package executes one or more commands associated with malicious behavior.

Malicious versions

12 flagged

0.0.1-security3.8.23.9.33.9.43.10.03.11.33.12.33.13.33.14.43.16.43.17.459.2.12

Indicators of compromise (SHA-256)

e2c0a16ffe671f9c77004faf2da2d2acfa8dff592a10ed38cb46d4fae9278cf5

7b3f879f1bd8bf56a2aa90c85bc3df0e65ffac635f34f866275a1cdaf2bf5472

7f86ec2b3a093bd7c2c4901b4c9aab7e6a2a7ab85647d923f113ff538acda32a

b469989896756eb6f6ccb417fda994e1220e80b1b2ab105cc6ae107bac2f5eda

1fbb34ab024548b54ee3d615e7307f494032d389d60d0e64bcc1330e92fe4f21

5e4b55eeb74e3380221d828a81a74d2dc0e50e8f0a7624d5f46c5280dbdb2c64

85cdc1cb188ff303c62d58efe589bc9de82f2e38c7eedddf3c284ed8e8a42a91

137a58343e4013b5ccfab74967afb891e2df1c09ec113e57e194db9c034c799d

1574bcebb9864c65bd4b20709c69484669df35bfedc89689488deaaaaad023bb

48900db6cadc3505f91e813bb80937a94d06fb2ddc601b947a8ada675fb456fe

75f81c0c55a073e61775b1cfff607f2b474da87cd87cfd725a44be4d8ebea496

Detection & response playbook

Malicious package

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for overstock-logger (12 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging overstock-logger across your stack and pipelines.
If you installed it — respond
Remove overstock-logger from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If overstock-logger was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks overstock-logger before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. overstock-logger on npm has been identified as a malicious package (versions 0.0.1-security, 3.8.2, 3.9.3, 3.9.4, 3.10.0, 3.11.3, 3.12.3, 3.13.3, and 4 more flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2024-01525RLUA-2024-07048GHSA-2pfg-gwg8-4mvqRLUA-2026-01474

References

github.com

Credits

OpenSSF: Package Analysis · finder
ReversingLabs · finder

Detect & block this

O3 blocks overstock-logger-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database