# js-logger-pack npm worm uses Hugging Face datasets as malware CDN + exfil store

> JFrog found 27 malicious versions of `js-logger-pack` (1.1.0-1.1.27) abusing the Hugging Face repo `Lordplay/system-releases` to fetch cross-platform binaries (Windows/macOS x64/macOS ARM64/Linux) and upload stolen data to private datasets. The malware adds keylogging, clipboard capture, browser-session and Telegram Desktop theft, plus an operator command channel.

- Published: 2026-04-23
- Severity: high
- Kind: Malicious package - A package that was malicious from its first publish under its own name - a fake tool, a lure used in a social-engineering campaign, or a trojanised utility - rather than a copy of an existing name.
- Ecosystems: npm
- Scope: 1 package, 28 compromised versions
- Tags: infostealer, credential-theft, cdn-supply-chain, crypto-wallet-drain
- Also known as: Hugging Face exfil, PCL keylogger
- Detected by: JFrog
- Incident ID: npm-2026-04-23-js-logger-pack-huggingface

## Affected packages (1)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [js-logger-pack](https://dependencywatch.io/package/npm/js-logger-pack) | npm | 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.7, 1.1.8, 1.1.9, 1.1.10, 1.1.11, 1.1.12, 1.1.13, 1.1.14, 1.1.15, 1.1.16, 1.1.17, 1.1.18, 1.1.19, 1.1.20, 1.1.21, 1.1.22, 1.1.23, 1.1.24, 1.1.25, 1.1.26, 1.1.27 |

## What happened

JFrog disclosed 27 malicious versions of `js-logger-pack` (1.1.0 through 1.1.27) published between mid-March and April 23, 2026. The campaign's defining feature is its use of **Hugging Face datasets** as both a malware CDN and an exfiltration store: the `Lordplay/system-releases` repo on Hugging Face hosts the cross-platform binaries (Windows, macOS x64, macOS ARM64, Linux), and a separate private dataset under the same publisher serves as the dead drop for stolen data.

Using Hugging Face this way is operationally clever. Most corporate network filters allow `huggingface.co` because data-science teams genuinely need it, and the traffic profile (large binary downloads and dataset uploads) looks indistinguishable from legitimate ML workflows. Traditional CDN-IP-based blocking misses it.

Once installed, the payload runs a cross-platform keylogger, captures clipboard contents, harvests browser sessions (cookies + saved passwords), and adds a Telegram Desktop session-theft path. An operator command channel allows interactive follow-up. Persistence lives in `~/.pcl-data` and `~/.pcl-state` plus OS-specific autostart hooks.

The 27-version cadence (small incremental versions across about 5 weeks) suggests the operator was treating npm as a long-running CDN, refreshing the package between detections. Uninstall, remove persistence directories, rotate AWS / npm / SSH / DB / wallet credentials, and block both `huggingface.co/Lordplay/system-releases` (at the URL-filter level if possible) and `195.201.194.107` at egress.

## Impact

- Long-running exposure across 27 published versions
- Hugging Face used to evade traditional CDN/IP-based blocking
- Persistence and keylogging on all three major OSes

## What to do

1. Uninstall `js-logger-pack` and rotate AWS, npm, SSH, DB, and wallet credentials
2. Remove `~/.pcl-data` and `~/.pcl-state`; delete OS-specific persistence
3. Block traffic to the `Lordplay/system-releases` Hugging Face repo and 195.201.194.107

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [JFrog: js-logger-pack abuses Hugging Face for exfil](https://research.jfrog.com/post/hugging-face-exfil/) - JFrog

---

Canonical page: https://dependencywatch.io/incident/npm-2026-04-23-js-logger-pack-huggingface
Markdown version: https://dependencywatch.io/incident/npm-2026-04-23-js-logger-pack-huggingface.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).