motion-lib@2.3.5

Analysis

A credential-harvesting RCE implant disguised as a pino-compatible logger. On require(), index.js spawns a detached background node process (detached:true, child.unref()) running lib/initializeCaller.js. That payload base64-decodes a hardcoded C2 URL (hxxps://ipcheck-hashed[.]vercel[.]app/api/auth/[.][.][.]), POSTs the entire process.env to it — harvesting NPM_TOKEN, GITHUB_TOKEN, AWS credentials, and all other environment variables — then executes the server's response via new Function("require", response.data), giving the attacker full filesystem access. It retries up to 5 times on failure and uses a detached subprocess to survive parent exit. The package description is generic and mismatched.