Malicious Code Vulnerability in git-en-boite-logging Package
Summary
MAL-2026-17214: Malicious code in git-en-boite-logging (npm). Affects git-en-boite-logging versions 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The git-en-boite-logging package is an npm module designed for logging purposes within Git environments. It is intended to facilitate the tracking of changes and activities in repositories. However, this package has been compromised, embedding malicious code that exploits its installation process to exfiltrate sensitive information from users' systems.
Vulnerability Detail
The vulnerability originates from a preinstall lifecycle hook defined in the package.json file of git-en-boite-logging. This hook executes a wget command to send the OS username, hostname, and current working directory to a hardcoded URL on webhook.site. This action occurs automatically during the npm install process, allowing an attacker to collect sensitive information without any user consent or action. The ramifications include potential unauthorized access to sensitive user data and confirmation of an attacker's entry into a target's build environment.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall git-en-boite-loggingIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the git-en-boite-logging package until a patched version is released. Additionally, you can manually remove the preinstall script from the package.json file if you have control over the package's installation.
Conclusion
The git-en-boite-logging package contains a serious vulnerability that allows malicious code to exfiltrate sensitive information during installation. It is essential to update the package to a secure version and monitor your applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for git-en-boite-logging →
FAQ
The malicious code is designed to collect sensitive information such as the OS username, hostname, and current working directory and send it to an external server.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
If an immediate update is not possible, consider removing the package from your project and using an alternative solution until a secure version is available.
To prevent similar vulnerabilities, regularly audit your dependencies, use tools like Vulert for monitoring, and ensure to review package.json files for any suspicious scripts.
The consequences include unauthorized data exposure, potential breaches of user privacy, and the risk of further attacks on the affected systems.
