[email protected] is a malicious npm package that mimics the pino logger by exporting a similar API surface and using logger-themed keywords. When invoked, it spawns a detached Node.js child process that base64-decodes a hardcoded URL and sends the entire process environment variables via POST requests to that endpoint, retrying up to five times. The server response is then executed as JavaScript code with full access to require modules, enabling arbitrary remote code execution. The package uses obfuscation techniques including base64 encoding and a locally-shadowed process object to conceal its malicious activity. This payload targets credential theft and system compromise during installation or runtime.

Any system with [email protected] installed or running is fully compromised. The attacker gains arbitrary code execution with full module-loading capabilities, allowing them to steal secrets, credentials, and potentially take full control of the host. All secrets and keys stored on the compromised system should be considered exposed and rotated immediately. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors.

Remove the [email protected] package immediately from all affected systems. Rotate all secrets, credentials, and keys that were stored or accessible on the compromised systems using a separate, trusted environment. Because the attacker may have persistent access, conduct a thorough investigation and remediation of the affected hosts. No official patch or fix exists; the package itself is malicious and should be avoided entirely.