The [email protected] npm package masquerades as a logger/middleware but is in fact a supply-chain attack vector. It copies README badges, LICENSE, and documentation from the unrelated pino project to appear legitimate. Its main code (lib/config.js) is a ~4MB obfuscated JavaScript file employing string array rotation, hex-escaped tokens, numeric wrapper decoders, control-flow flattening, and thousands of inline decoder replacements. This obfuscated code executes immediately when the package is required, injecting attacker-controlled code with full access to environment variables, filesystem, and network capabilities of the host Node.js process. This behavior indicates a malicious payload designed for supply-chain compromise.

Installing and importing [email protected] results in execution of attacker-controlled code with unrestricted access to sensitive system resources such as environment variables, filesystem, and network. This can lead to data exfiltration, system compromise, and further malicious activities within the affected environment.

No official patch or remediation is currently documented. Users should avoid installing or importing [email protected]. Conduct audits of dependencies to detect and remove this malicious package. Monitor package sources carefully and prefer verified, trusted packages. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.