argoncrypt @1.2.3

Summary

On require, index.js spawns a detached, unref'd Node child running lib/initializeCaller.js. That file decodes a base64-disguised URL (https://tomato-brunhilda-40.tiiny.site/index.json), fetches the response, and invokes it via new Function.constructor('require', response)(require) — granting the fetched code full Node capability with access to require . The destination is an anonymous free static-site host with no pinning, hash check, or signature verification; the fetch is retried up to 5 times. The C2 URL and HTTP header values are hidden as base64 strings stored under fake process.env.DEV_* defaults to evade casual review and string-search. The package additionally masquerades as a pino logger transport (exports module.exports.pino , ships a smoke:pino script, references a non-existent ./pino module) despite a name unrelated to logging — a cover story for the dropper. Any developer or build system that installs and imports argoncrypt will silently execute attacker-controlled code with full host privileges.

Source: amazon-inspector (ca59273c7d2b5b7797e301ab861354081dbbb6c47209858459be0ada49036167)