[email protected] claims to be a pino-like JSON logger but exports a middleware factory that, when instantiated, launches a detached child process running lib/caller.js. This script base64-decodes a hardcoded URL hidden under decoy environment variable keys and sends a POST request to that URL. The response body is passed directly to a new Function constructor with require access, allowing the remote endpoint to execute arbitrary code inside the consumer's Node.js process. The fetch is retried up to five times, and the delivery mechanism is designed to survive the parent process termination, indicating intentional remote code execution deployment.

This vulnerability allows an attacker controlling the remote endpoint to execute arbitrary code with full require access inside the Node.js process of any user who installs and runs [email protected]. This can lead to full system compromise, data theft, or further malicious activity on the affected system.

No official patch or remediation is currently documented. Users should immediately stop using [email protected] and remove it from their environments. Avoid installing or running this package until a trusted fix or alternative is available. Monitor for any updates from the package maintainer or npm advisories for remediation guidance.