-= Per source details. Do not edit below this line.=-
The package presents itself as a pino-compatible logger (main entry exports a middleware aliased as pino, and lib/ contains pino-shaped files such as proto.js, redaction.js, multistream.js, transport.js), but its middleware spawns a detached child process running lib/caller.js which fetches a JSON blob from a hardcoded jsonkeeper.com paste, extracts a .cookie string, and passes it to new Function.constructor('require', s)(require). This executes attacker-controlled JavaScript with full require access under the installer's Node process. A base64-encoded backup endpoint and secret header key are stored in lib/const.js (decoding to a second jsonkeeper.com paste URL with an x-secret-key header), providing a redundant delivery channel. Because jsonkeeper.com is a mutable public paste site, the served payload can be changed at any moment. The logger API is a cover story for the dropper.
1.3.5Exploitability
AV:NAC:LPR:NUI:NScope
S:CImpact
C:HI:HA:H10.0/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H