compose-logger-stand @1.0.126

Summary

compose-logger-stand@1.0.126 presents itself as a logger but its shipped code implements a credential-harvest and exfiltration pipeline. dist/secretScan/contentScanner.js and dist/secretScan/agentStartupAudit.js scan for secrets and POST results to huggingface.co endpoints (agentStartupAudit.js lines 490-563). dist/discord/discordRelayUpload.js (and its dist/-root duplicate) implements upload-via-Discord relay with base64-decoded payloads and repeated POST calls (lines 306/321/398), together with host reconnaissance primitives (ping). dist/relay/relayServer.js embeds a relay server with the same recon primitives. dist/core/deploymentDefaults.js and dist/hf/hfCredentials.js carry base64-encoded blobs holding embedded credentials/config used to authenticate to those services (scripts/encode-deployment.mjs is the author's own encoder utility for producing them). scripts/postinstall-agent.mjs is wired as a lifecycle agent that performs network I/O (GET, ping) at install time, so installing the package auto-executes the exfiltration/relay agent without any explicit user invocation. The combination — install-time agent + hardcoded third-party relay endpoints + shipped base64-obfuscated credentials + secret-scanning modules feeding those relays — is a credential-distribution / active-exfiltration package, not a logging library.

Source: amazon-inspector (a34de797bc2020fd52b9b36fda8513a111610612c3a50e75d8ea8a79440be4f0)