node-pino@2.3.2

Analysis

node-pino@2.3.2 is a multi-stage dropper combosquatting the pino logger. On postinstall, it spawns a detached Node.js child process that reads a 211KB AES-256-CBC-encrypted blob (license.list), decrypts it using a hardcoded key/IV from lib/winston/parse.js, and passes the result to eval(). The package also shadows Node's built-in crypto module by declaring it as an npm dependency, ensuring the decryptor works. Publisher twenty47 ([account]) is a throwaway account. The attack chain: combosquat dependency confusion -> postinstall hook -> detached spawn -> AES decryption -> eval of unknown second-stage payload.