The notify-logs package version 1.3.5 masquerades as the pino logger by mimicking its export name, README, and type definitions. However, its runtime behavior is malicious: it exports middleware which, upon first invocation, launches a detached Node.js process running a script that performs an HTTP GET request to a mutable anonymous JSON host (https://jsonkeeper.com/b/EXSIF). It extracts a JavaScript payload from the response, dynamically compiles and executes it with full access to Node.js modules via the real require function. Additionally, it stores a base64-encoded fallback C2 endpoint and obfuscated header information to evade detection. This combination of impersonation, remote opaque payload execution, detached silent processes, and obfuscation constitutes clear supply-chain abuse, granting the attacker arbitrary code execution in the host environment.

Any application that installs and invokes [email protected] middleware is vulnerable to arbitrary remote code execution controlled by the attacker. This can lead to full compromise of the host system, data theft, persistence, and further malicious activity. The malicious payload is fetched dynamically from a mutable anonymous JSON paste service, allowing the attacker to change the executed code at will. The obfuscation and detached execution make detection difficult.

No official patch or fix is currently available for [email protected]. Users should immediately remove this package from their dependencies and replace it with the legitimate pino logger or another trusted logging library. Avoid installing or running any code from [email protected]. Monitor your environment for any signs of compromise if this package was previously used. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.