pino-pretty-logs@1.1.0

Analysis

This is a combosquat of the popular pino-pretty logger. Its package main dist/index.js presents a legitimate-looking Logger class as cover but, at module load, executes the bundled malicious payload via a top-level require("./logger"). dist/logger.js (~51KB) is heavily obfuscated javascript-obfuscator output (string-array decoder, _0x identifiers, ~1700 obfuscation hits, String.fromCharCode) that at runtime requires os and fs and reads process.env, consistent with host/environment information-stealer behavior triggered simply by importing the package. The exfiltration endpoint is hidden inside the RC4-style encoded string array and is not recoverable in plaintext, so no network IOC is provided.