metrica-node@2.4.5

Analysis

A remote-code-execution dropper disguised as a pino logging library. On require(), index.js spawns lib/caller.js as a detached background process (detached:true, stdio:"ignore", child.unref()) that survives parent exit. caller.js fetches a second-stage payload from jsonkeeper[.]com/b/BADC6 (base64-obfuscated: 'aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL0JBREM2' decodes to that URL) with an auth header (x-secret-key: _), then executes the response's 'cookie' field via new Function.constructor("require", payload), giving the attacker unrestricted Node.js require access on the victim machine. The package clones pino's internals (lib/tools.js, lib/proto.js, 40KB+ docs/) as camouflage, and the description is a nonsensical template.