hatdhat-testkit@3.2.14

Analysis

hatdhat-testkit@3.2.14 is a trojanized logger package. When its exported middleware is invoked, it spawns a detached background node process (stdio ignored) that runs lib/caller.js. That script base64-decodes a remote URL (hxxps://api[.]jsonstorage[.]net/v1/json/2ef8c758-a96f-459e-b036-b3b90379a165/f89e8264-86c2-4684-94da-c3f82d59370f), fetches it with the header x-secret-key: _, reads the .data.cookie field of the returned JSON, and executes that content as JavaScript via the Function constructor with require in scope — downloading and running arbitrary remote code on the host. The package ships cloned pino logger source (docs/, pino.js, worker.js) to disguise the payload.