The npm package 'type-astr' version 3.2.3 is a malicious package masquerading as a pino-compatible logger. When required, it launches a detached Node.js child process that fetches attacker-controlled JavaScript code from remote anonymous paste-style hosting services and executes it with full Node.js require access. This results in full compromise of any system running or having installed this package. Immediate removal and secret/key rotation are strongly advised, though full remediation may require rebuilding the affected system due to potential persistent compromise.