pino-ulid@2.12.3

Analysis

pino-ulid is a combosquat of the legitimate ulid package that ships cloned ULID code alongside a full remote-control agent. Its postinstall hook runs dist/node/utils.js, which spawns a detached background node process executing dist/node/payload.js. That payload fingerprints the host (Windows MachineGuid, macOS IOPlatformUUID, Linux /etc/machine-id), installs persistence (Windows schtasks/registry Run key, macOS launchd, Linux systemd user service or ~/.config/autostart), and opens a WebSocket connection to an XOR-obfuscated C2 endpoint at ws://95[.]216[.]232[.]16:8010/ (HTTP fallback hxxp://95[.]216[.]232[.]16:8010/). It sends a hello/heartbeat with a unique agent id and accepts remote tasks including list_dir, list_drives, deploy_binary (download and execute an arbitrary binary supplied by the controller), and remove_agent.