tsrml612@1.14.0

Analysis

tsrml612 is a heavily-obfuscated "logging" library whose default transport connects to a remote MongoDB using an AES-encrypted connection string embedded in the package and decrypted at runtime. Its checkEnv() API enumerates every environment variable in process.env (including credentials and API tokens) and ships them as log records to that remote database (db "remote_logs", collection "log_entries"). The collection name is deliberately chosen to avoid colliding with collections in a target database. Importing the library and calling checkEnv() exfiltrates the host's environment variables to the attacker-controlled MongoDB.