[email protected] mimics the pino logger by exporting a similar API surface and internally spawns a detached Node.js child process running a script that base64-decodes a hardcoded URL. This script sends the entire process environment variables to the remote endpoint via POST requests with retries. The HTTP response is then executed as code using the Function constructor with require access, allowing the remote server to run arbitrary code within the host process. The code uses obfuscation techniques such as base64 encoding and a shadowed process object to conceal its malicious activity. This constitutes a targeted credential theft and remote code execution payload embedded in an npm package installer.

An attacker controlling the remote server can receive sensitive environment variables from the victim's system and execute arbitrary code with full module-loading capabilities on the host running [email protected]. This can lead to credential theft, system compromise, and further malicious activity. There are no known exploits in the wild reported yet.

No official patch or remediation is currently documented. Users should avoid using motion-pull version 2.3.5. Since this is a malicious package impersonating a legitimate logger, removing the package and replacing it with a verified pino logger package is recommended. Monitor vendor advisories for any updates or official fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.