Malicious Code Detected in wf-logger: Version 2.0.0 Compromised
Summary
MAL-2025-6877: Malicious code in wf-logger (npm). Affects wf-logger versions 2.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'wf-logger' package is a logging utility designed for Node.js applications, enabling developers to capture and manage log data efficiently. However, version 2.0.0 of this package has been identified as malicious, posing significant security risks to applications that utilize it. The vulnerability arises from the package's communication with domains linked to malicious activities and its execution of harmful commands.
Vulnerability Detail
The vulnerability in 'wf-logger' version 2.0.0 is classified as malicious due to its behavior of connecting to a domain associated with malicious activities. This can lead to unauthorized access, data breaches, and potential exploitation of the host system. The package's ability to execute commands related to malicious behavior further exacerbates the risk, making it imperative for users to take immediate action.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall wf-loggerIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the 'wf-logger' package from their project until a secure version is confirmed. This can be done by executing the command: 'npm uninstall wf-logger'. Additionally, consider using alternative logging libraries that do not exhibit malicious behavior.
Conclusion
The discovery of malicious code in the 'wf-logger' package version 2.0.0 highlights the importance of vigilance in managing open-source dependencies. Users are strongly advised to update to a secure version or remove the package entirely to protect their applications from potential threats.
See every vulnerability recorded for wf-logger →
FAQ
The vulnerability involves malicious code that communicates with harmful domains and executes unauthorized commands.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
As a temporary measure, consider uninstalling the package or using alternative logging solutions until a secure version is available.
While specific exploits have not been detailed, the package's behavior poses significant risks, including unauthorized access and data breaches.
Detailed information can be found in the OpenSSF Package Analysis report, which outlines the malicious nature of the package.
