argoncrypt@1.2.3

Analysis

TRUE POSITIVE — remote-code-execution dropper. lib/initializeCaller.js decodes base64-embedded URL "hxxps://tomato-brunhilda-40[.]tiiny[.]site/index[.]json", fetches it via axios.get(), extracts .data.cookie, and executes it via new Function.constructor("require", response) — giving the remote payload full Node.js require(). index.js silently spawns this as a detached child process (detached:true, stdio:'ignore', child.unref()) when the Express middleware is imported. Package masquerades as the pino logger (bundles pino docs/internals) under the unrelated name "argoncrypt". Publisher [account] tiiny[.]site is a known malware C2 hosting domain. No lifecycle hook needed — requires only require(). This is an active RCE supply-chain attack.