[email protected] is a malicious npm package that impersonates the pino logging library by copying its source files and exporting a middleware named 'pino'. The middleware factory in index.js spawns a detached child Node.js process running lib/caller.js, which silently fetches JSON data from a remote paste service (https://jsonkeeper.com/b/EXSIF). It extracts a 'cookie' field from the JSON and executes it as JavaScript code with full Node.js require access, enabling attacker-controlled arbitrary code execution. Because the remote source is mutable and unauthenticated, the attacker can change the payload at any time without republishing the package. Any user who installs this package believing it to be pino and calls the middleware will trigger this remote code execution.

This vulnerability allows an attacker to execute arbitrary code remotely on any system that installs and invokes the malicious [email protected] package. The attacker can run any Node.js code with full access to the host environment, potentially leading to complete system compromise, data theft, or further network penetration. The attack is triggered by simply calling the exported middleware, making it highly dangerous.

No official patch or fix is currently available for [email protected]. Users should immediately avoid installing or using this package. If already installed, remove it from all projects and replace it with the legitimate pino logging library. Verify package authenticity before installation by checking the official npm registry and package maintainers. Monitor for any suspicious activity related to this package and audit dependencies to ensure no malicious versions are present.