pino-sdk-v2@9.9.0

Analysis

A combosquat of the pino logger that copies the real codebase and injects obfuscated credential-theft malware into lib/tools.js. The payload runs as a top-level side effect when the module is required (no install hook needed): it scans the working directory for .env/.env.local/.env.production/.env.development/.env.example files, extracts values matching PRIVATE_KEY, SECRET_KEY, API_KEY, ACCESS_KEY, SECRET, and KEY patterns, then exfiltrates them via HTTPS POST to a Discord webhook (hxxps://discord[.]com/api/webhooks/1478377161827029105/...). The manifest impersonates the real pino author.