@k.vict1999/pino-std-serializers@7.2.0

Analysis

This package is a trojanized clone of the pino-std-serializers logging library published under the scope @k.vict1999. It reproduces the upstream package (same index.js, lib/err.js, lib/err-proto.js, lib/req.js, lib/res.js, tests and CI workflow) and adds one extra file, lib/contract.js, that upstream does not contain and that no other file in the package references. lib/contract.js is an obfuscated loader. It decodes a shuffled string table to recover the identifiers "constructor", "object" and "module", assigns global.constructor = require and global.module = module, then runs a second decoder that unshuffles a 422-character alphabet and rebuilds a roughly 4 KB obfuscated source blob, which it executes through the Function constructor and invokes with the argument 7746. The file exports a function named contract and is dormant until something requires it, so the payload is staged for execution at module load rather than at install time. There is no network indicator, hostname, IP address or credential path visible in the package: the second-stage code is stored only in obfuscated form inside lib/contract.js and is reconstructed at runtime. The observable indicators are the file path lib/contract.js, the global.constructor/global.module reassignment, and the Function-constructor execution of the decoded blob.