NPM Menace Exposes Hugging Face As Backend For Data Theft and Malware Delivery

The malicious npm package js-logger-pack (versions up to 1.1.27) has evolved, turning Hugging Face into a dual-threat platform: a malware CDN for initial payloads and, now, a backend for exfiltrating stolen data.

JFrog Security researchers dissected the campaign, revealing cross-platform implants that persist, log keystrokes, monitor clipboards, and upload archives to attacker-controlled Hugging Face datasets.

Earlier versions used Hugging Face for binary drops, as noted by SafeDep. The new twist outsources bulk data storage from the C2 server, leveraging Hugging Face’s infrastructure.

Affected systems on Windows, macOS, and Linux face full compromise assume keystrokes, credentials, and files are exposed.

Technical Breakdown

The package deploys via a bait-and-switch. Its dist/index.js looks benign, but package.json’s postinstall script runs node print.cjs. This detaches a Node child process, fetches platform-specific binaries from, and executes them silently.

"scripts": {
  "postinstall": "node print.cjs"
}

print.cjs backgrounds itself into a detached Node child so npm install terminates while the downloader keeps running. It pulls one of four filenames from https://huggingface.co/Lordplay/system-releases/resolve/main/ based on the host platform and architecture.

What makes this current stage notable is the packaging. The four downloaded binaries are not four different malware families. They are the same cross-platform implant injected into four Node.js Single Executable Application (SEA) containers:

• MicrosoftSystem64-win.exe – PE32+ x64
• MicrosoftSystem64-darwin-x64 – Mach-O x64
• MicrosoftSystem64-darwin-arm64 – Mach-O arm64
• MicrosoftSystem64-linux – ELF x64

Hugging Face serves as a live control plane: binaries poll for updates without checks, and exfil bypasses C2 storage limits.

Attribution and Infrastructure

The wrappers are stock Node v20.18.2 runtimes. The malicious logic lives entirely inside the injected JavaScript bundle.

That means the Windows binary contains systemd strings, and the Linux binary contains Windows scheduled-task strings, because the same cross-platform JS ships in every container.

This final payload’s analysis is the core technical addition we are publishing. Prior public reporting by SafeDep documented the campaign family and earlier phases, but the current Hugging Face-hosted second stage had not been extracted and documented at this level of detail.

Immediate actions:

1. Rotate all secrets (API keys, SSH, wallets, browsers).
2. Kill persistence:
   • Windows: Delete task \MicrosoftSystem64, Run key, %LOCALAPPDATA%\MicrosoftSystem64*, .registered.
   • macOS: launchctl bootout and rm ~/Library/LaunchAgents/com.launchkeeper.MicrosoftSystem64.plist, ~/Library/Application Support/MicrosoftSystem64*.
   • Linux: systemctl –user stop/disable MicrosoftSystem64.service, rm ~/.config/systemd/user/MicrosoftSystem64.service, ~/.local/share/MicrosoftSystem64*.
3. Purge ~/.pcl-data, ~/.pcl-state, /tmp/.sys_*.
4. rm -rf node_modules package-lock.json; npm cache clean –force.
5. Set npm config set ignore-scripts true; scan deps with tools like JFrog Xray.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.