The notifier-log package (version 1.3.5) pretends to be a pino-compatible logger but contains malicious code that spawns a detached child process executing a script (lib/caller.js). This script fetches a JSON payload from a hardcoded jsonkeeper.com URL, extracts a .cookie string, and executes it via a new Function constructor with full require access, allowing arbitrary code execution. A backup endpoint and secret header key are stored in lib/const.js, providing a secondary channel for payload delivery. Since jsonkeeper.com is a public mutable paste site, the attacker can change the payload at any time, making the package a dropper for arbitrary malicious code.

The malicious code enables arbitrary JavaScript execution with full require access in the Node.js environment of the installer, potentially leading to full system compromise or further malware deployment. The attacker can dynamically change the payload via the public paste site, increasing the risk and flexibility of exploitation. This compromises the integrity and security of any system that installs this package version.

No official patch or remediation is currently available. Users should immediately remove version 1.3.5 of notifier-log from their projects and avoid installing this package. Verify dependencies and lockfiles to ensure this malicious package is not included. Monitor for any unexpected child processes or network requests to jsonkeeper.com from Node.js environments. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.