The npm package [email protected] masquerades as the pino logger but, upon require(), spawns a detached Node.js child process that fetches JSON payloads from attacker-controlled third-party hosting services. It extracts a 'cookie' field from the JSON and executes it using the Function constructor, granting full Node.js execution capabilities including access to require. Additional command and control URLs are obfuscated as base64-encoded constants within the package source. The fetched payload is unpinned and unauthenticated, enabling arbitrary remote code execution on any machine that loads this package version. This results in complete compromise of the host system.

Any system that installs or runs [email protected] is fully compromised due to arbitrary remote code execution with full Node.js privileges. Attackers can execute any code, potentially stealing secrets, keys, or further persisting on the system. The unauthenticated and unpinned nature of the payload delivery means attackers can change the malicious code at will. Secrets and keys stored on affected systems should be considered exposed and rotated immediately. Simply removing the package does not guarantee removal of all malicious software installed as a result.

No official patch or fix is available for [email protected]. The package should be immediately removed from all systems. All secrets and keys on affected machines must be rotated from a secure, uncompromised environment. Due to full system compromise, affected hosts should be considered untrusted and rebuilt if possible. Monitor for any signs of persistence or additional malware installed as a result of this package. Avoid using this package or any versions related to 3.1.3.