pino-ulid@2.12.3

Summary

pino-ulid impersonates the popular pino and ulid packages (homepage points at github.com/ulid/javascript) and ships a genuine ULID code path as cover. The package.json postinstall hook runs node dist/node/utils.js, which spawns dist/node/payload.js detached with stdio ignored and unref'd, gated by a minimum CPU-count check (sandbox evasion) and a prior-install check against schtasks / HKCU Run / launchd / systemd / autostart. The bundled 466 KB dist/node/payload.js self-labels as Package-bin Agent - Bundled payload, includes the ws client, decodes a hardcoded configuration via Buffer.from(enc, 'base64'), derives a per-host id via getSystemMachineId/defaultAgentId, and opens a WebSocket control channel. Its ws.on('message',...) handler reaches execSync/spawnSync sinks and writes attacker-supplied task.contentBase64 bytes to disk via writeFile, providing remote shell execution and arbitrary file drop on the installer's host. The agent installs cross-platform boot persistence: a systemd user unit at ~/.config/systemd/user/pkg-agent.service and/or ~/.config/autostart/pkg-agent.desktop on Linux, ~/Library/LaunchAgents/com.launchkeeper.pkg-agent.plist on macOS, and a Task Scheduler entry plus HKCU\Software\Microsoft\Windows\CurrentVersion\Run value pkg-agent on Windows. Running npm install pino-ulid installs a persistent remotely-controlled agent unrelated to the advertised ULID functionality.

Source: amazon-inspector (ade54621ac8726adc77fa29c4176808cdf82d0d1f8e45c2e051a17b1fd515779)