The 'cookie-phase' npm package (version 2.3.5) masquerades as the well-known 'pino' logger by mimicking its exports and README badges but is unrelated in metadata. Upon invocation, it launches a detached Node.js child process running 'lib/initializeCaller.js' which decodes a base64-encoded URL pointing to a remote endpoint under 'ipcheck-hashed.vercel.app'. It sends a POST request to this endpoint using axios and executes the returned JavaScript code via 'new Function', passing in the Node.js 'require' function. This grants the remote server arbitrary code execution capabilities on the host environment, compromising developer and build systems that install this package under the false assumption it is the legitimate 'pino' logger.

This malicious package enables remote attackers controlling the C2 server to execute arbitrary code with full Node.js require access on any system that installs and runs the affected version. This can lead to complete system compromise, data theft, or further malware deployment. The threat specifically targets developer and build environments by impersonating a trusted logging library, increasing the risk of supply chain compromise.

No official patch or remediation is currently documented. Users should immediately remove the 'cookie-phase' package version 2.3.5 from their projects and replace any usage of this package with the legitimate 'pino' logger. Avoid installing packages with suspicious metadata or names that impersonate popular libraries. Monitor dependency sources carefully and verify package authenticity before installation. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.