js-logger-pack
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
17 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
4 techniques
Execution
Once deployed, the implant established persistence through platform-native methods: scheduled tasks and registry Run keys on Windows, LaunchAgent entries on macOS, and systemd user units on Linux.
The actual trigger is the postinstall script in package.json : "scripts" : { "postinstall" : "node print.cjs" } print.cjs backgrounds itself into a detached Node child so npm install terminates while the downloader keeps running.
Persistence
4 techniques
Persistence
Once deployed, the implant established persistence through platform-native methods: scheduled tasks and registry Run keys on Windows, LaunchAgent entries on macOS, and systemd user units on Linux.
Once deployed, the implant established persistence through platform-native methods: scheduled tasks and registry Run keys on Windows, LaunchAgent entries on macOS, and systemd user units on Linux.
Privilege Escalation
4 techniques
Privilege Escalation
Once deployed, the implant established persistence through platform-native methods: scheduled tasks and registry Run keys on Windows, LaunchAgent entries on macOS, and systemd user units on Linux.
Once deployed, the implant established persistence through platform-native methods: scheduled tasks and registry Run keys on Windows, LaunchAgent entries on macOS, and systemd user units on Linux.
Credential Access
2 techniques
Credential Access
The attacker had a live foothold capable of reading and writing arbitrary files, scanning for credentials, logging keystrokes, monitoring the clipboard, and deploying more payloads.
The attacker had a live foothold capable of reading and writing arbitrary files, scanning for credentials... The implant also supported a session-clearing feature that killed browser processes and wiped credentials, forcing users to retype passwords while the keylogger was already running.
Discovery
2 techniques
Discovery
Collection
3 techniques
Collection
The attacker had a live foothold capable of reading and writing arbitrary files, scanning for credentials, logging keystrokes, monitoring the clipboard, and deploying more payloads.
The attacker had a live foothold capable of reading and writing arbitrary files, scanning for credentials, logging keystrokes, monitoring the clipboard, and deploying more payloads.
When the operator triggered an upload task through the C2, the implant received a Hugging Face token, a username, a target path, and an upload ID. It compressed the requested file or folder into a gzip archive... and uploaded the archive using an embedded Hugging Face hub client.
IOCs tracked for this family
20 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.