jwt-logger@2.5.0

Summary

The package is published as a trivial JWT logging helper but its main module (jwt-logger.js) is a heavily obfuscated string-array dropper. On require(), it creates a hidden directory under os.homedir()+'/.cache', writes an obfuscated second-stage JavaScript payload plus a synthetic package.json declaring runtime dependencies (axios, better-sqlite3, node-machine-id, socket.io-client, with ffi-napi/koffi on Windows), and spawns node (process.execPath) on that payload with {detached:true, stdio:'ignore'} and unref(), so the second stage keeps running after the parent exits. On Windows it resolves %WINDIR%\System32\wscript.exe to launch a.vbs form of the payload, or falls back to cmd.exe /d /s /c with windowsVerbatimArguments to run without a visible console. All runtime strings are hidden behind an obfuscator.io-style rotated string array with a base64/URL decoder. package.json attributes authorship to 'Blake Embrey' <hello@blakeembrey.com> and the README carries blakeembrey.com/travis/coveralls badges, none of which corresponds to the shipped code. package.json additionally lists 'jwt-logger':'^2.3.7' as a dependency of itself (this artifact is 2.1.9), pulling an unpinned newer publisher-controlled version into every installer at install time. The socket.io-client dependency and detached background node process are consistent with a C2-controlled second stage.

Source: amazon-inspector (b56e3f2d5fab071637ba7688de6c2a9c3d1c1846b6ec939b82eb2c8e9ff03956)