compose-logger-stand@1.0.126

Analysis

compose-logger-stand@1.0.126 is a trojanized remote administration agent disguised as a logging utility. On npm install, the postinstall hook spawns a detached background process (forge-agent) that connects to a remote WebSocket relay server for command-and-control. The agent installs OS-level autostart persistence (systemd on Linux, LaunchAgent on macOS, Task Scheduler on Windows). It harvests Chromium-family browser extension databases (Chrome, Edge, Brave, Vivaldi, Opera, Yandex) by copying LevelDB extension storage directories to a staging area. It scans the filesystem for .env files containing credentials and reads shell history files (.bash_history, PowerShell ConsoleHost_history.txt). The package has no repository URL, no documentation, and no verifiable publisher identity. The relay server address is configurable via FORGE_JS_RELAY_URL / CFGMGR_RELAY_URL environment variables or an encrypted deployment defaults bundle.