metrica-chain@2.4.5

Analysis

metrica-chain masquerades as a logger by vendoring large amounts of the legitimate pino logger internals to appear benign. Its entry point exports a no-op middleware that silently spawns lib/caller.js as a detached, unref'd child process with stdio:ignore. lib/caller.js base64-decodes a URL (hxxps://jsonkeeper[.]com/b/BADC6) and fetches stage-2 code via axios.get with a custom x-secret-key header; the fetched code is passed to new Function.constructor("require", s) and invoked with the full require scope, giving arbitrary code execution in the installer's context. It retries up to 5 times and suppresses console.log output to stay hidden.