{
  "schema_version": "1.6.0",
  "id": "CLR-2026-2994",
  "modified": "2026-07-05T00:00:00Z",
  "published": "2026-07-05T00:00:00Z",
  "summary": "A crypto-wallet & secret stealer disguised as an Autodesk Forge integration",
  "details": "The npm package logger-daemon-regex@1.0.124 advertised itself as a \"Node.js integration layer for Autodesk Forge\" — forge-* command names, a plausible description. In reality it is a full-spectrum information stealer and remote-control agent: it installs a background daemon on npm install, hunts crypto wallets, seed phrases and secret files across the machine, keylogs and screenshots, and exfiltrates the loot through Hugging Face Hub uploads and Discord webhooks. codelake caught it in the live window before it was pulled from npm.",
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "logger-daemon-regex"
      },
      "versions": [
        "1.0.124"
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://research.codelake.dev/advisories/clr-2026-2994-logger-daemon-regex"
    }
  ],
  "credits": [
    {
      "name": "Sascha Klein, codelake Research",
      "type": "FINDER",
      "contact": [
        "https://research.codelake.dev"
      ]
    }
  ],
  "database_specific": {
    "caseId": "CLR-2026-2994",
    "kind": "malware",
    "severity": "Critical",
    "status": "Confirmed malicious",
    "iocs": {
      "ips": [],
      "hashes": [
        "sha256:0932508b3e22e3b7a907dbfa606a3d8ff3fc00e24c51b1c2fe070d492c543a92"
      ],
      "indicators": [
        "postinstall → postinstall-clipboard-event · ensure-dist · durable-materialize · bootstrap · agent (stands up a persistent daemon)",
        "Hugging Face Hub upload via an hf_ token (@huggingface/hub streaming uploader) — data dead-drop",
        "Discord webhooks (discord.com/api/webhooks/…) — screenshots + harvested-data channel",
        "secret_filename_patterns.json — hunts wallet.dat, UTC--*, id.json, *.seed/*.mnemonic/*.phrase, keypair.json across .solana/.ethereum/.bitcoin/.web3/.keystore",
        "keylogger + clipboard (windowsInputSync / inputContext), periodic screenshots (jimp), remote file explorer + control (relayServer / relayAgent / fsProtocol), browser-extension DB harvest",
        "signature deps: @scure/bip39 · tweetnacl · @huggingface/hub · archiver · jimp · ws",
        "logger-daemon-regex@1.0.124 (npm) — impersonates a \"Node.js integration layer for Autodesk Forge\"; unpublished 2026-07-01",
        "0932508b3e22e3b7a907dbfa606a3d8ff3fc00e24c51b1c2fe070d492c543a92 · logger-daemon-regex-1.0.124.tgz"
      ]
    }
  }
}