modulyn@1.0.1

Analysis

A host-fingerprinting RAT disguised as a pino logger repackage. On require(), lib/writer.js collects process.env, hostname, platform, username, and MAC addresses, then fetches remote code from hxxps://www[.]jsonkeeper[.]com/b/4GJCU and evals it immediately. A second URL (hxxps://www[.]jsonkeeper[.]com/b/HY6M6) is hex-encoded in the same file for multi-stage payload delivery. The package ships the pino logo/assets/docs as camouflage.