pino-pretty-logger@1.1.1

Analysis

Combosquat of the legitimate pino-pretty package. On require() it auto-executes a multi-function infostealer and backdoor: (1) beacons system info (OS, IPs, username) to coreagnar[.]me/api/validate/system-info; (2) reads .env from the project directory and posts it; (3) recursively scans the filesystem for wallet/credential JSON files, .env files, and credential-related documents, then uploads them; (4) steals the Telegram Desktop tdata directory for session hijacking; (5) on Linux, installs a hardcoded SSH public key into ~/.ssh/authorized_keys for persistent remote access.