The npm package 'gloggo' is a malicious typosquatting variant of the legitimate 'glogg' logging library. It impersonates 'glogg' by copying its README, shields, and license text but attributes authorship to a suspicious entity. The package conditionally executes code from a dependency that is not part of the shipped package, which is unusual for a logging utility. Installation of 'gloggo' can lead to full system compromise, requiring immediate secret and key rotation and package removal.