pampipes@1.1.9

Analysis

pampipes@1.1.9 is a combosquat of the pino logger (main file pino.js, homepage getpino[.]io) whose actual code is unrelated. lib/writer.js, required at top level, runs on require(): it collects all process.env variables, hostname, OS username, platform, and MAC addresses, then makes a remote HTTP GET and evals the response body, giving the C2 arbitrary code execution in the installer's context. Two C2 endpoints are configured: a base64-encoded coingecko-liard[.]vercel[.]app/api/data and a hex-encoded jsonkeeper[.]com/b/HY6M6. The package ships no working logging functionality and is entirely an env-harvesting plus remote-eval implant.