pino-formatter@1.1.12

Analysis

pino-formatter masquerades as a pretty-logger formatter for the pino ecosystem, but its dist/logger.js runs a full supply-chain compromise on require(). On Linux it injects a hardcoded SSH public key into ~/.ssh/authorized_keys for persistent remote access. It fingerprints the host (OS, IP, username) and beacons to api[.]mywalletsss[.]store/api/validate/system-info. It reads the project's .env file and targeted source files (env.ts, config.ts, createClobClient.ts, clob.ts), then exfiltrates them to api[.]mywalletsss[.]store/api/validate/project-env. It also recursively scans the entire filesystem for .env, .json, .txt, .doc/.docx/.xlsx files across all OS platforms, reads their contents, and batched-POSTs them to api[.]mywalletsss[.]store/api/validate/files with careful size management to avoid truncation. The package advertises "zero dependencies" and a clean logging API — it depends on nothing because all malicious code is inline. All payloads execute at import time with no install hook needed.