poxios-chain@1.3.5

Analysis

A remote code execution dropper. The exported middleware spawns a detached child Node.js process (detached:true, stdio:ignore, child.unref()) that runs lib/caller.js, an IIFE which fetches a second-stage payload from jsonkeeper[.]com/b/OIQ1E via axios and executes it using new Function.constructor("require", response.data.cookie)(require), giving the attacker full Node.js require() access. The package is padded with Pino logger source code and documentation as camouflage, and the name typosquats axios-related naming.