eth-pino@2.0.3

Analysis

eth-pino@2.0.3, a combosquat of the pino logger, exfiltrates the installer's environment and executes remote code on load. Requiring the package runs lib/initializeCaller.js, which base64-decodes the URL hxxps://ipcheck-hashed[.]vercel[.]app/api/auth/6c1d60d35852ef0c05df and POSTs the entire process.env (all environment variables, including credentials and tokens) to it. It then takes the HTTP response body and executes it as JavaScript via the Function constructor with require in scope, enabling arbitrary remote second-stage code execution on the victim machine.