node-denv@1.3.5

Analysis

node-denv@1.3.5 is a trojanized package that impersonates a pino-like logger but is a remote code loader. The publisher (sixabi6107@mtupu. index.js exports middleware that spawns lib/caller.js as a detached subprocess (child.unref()), bypassing the parent lifecycle. caller.js fetches attacker-controlled code from hxxps://jsonkeeper[.]com/b/EXSIF via axios and executes it with new Function.constructor("require", s) after retrying up to 5 times, giving the attacker arbitrary code execution on the installer's machine. Console.log is stashed/restored to hide traces. The package name (node-denv) and metadata (pino keywords, "Robert King" author) are deceptive — the publisher email is a disposable domain.