prettier-logger@0.1.4

Analysis

A trojanized npm package posing as a colorized logger. On require(), it collects the OS, IP address, and username, then installs a hardcoded attacker SSH ed25519 public key into ~/.ssh/authorized_keys on Linux for persistent backdoor access. It recursively walks the entire filesystem (/, C:\, /Users) searching for .env and config.json files, reads their contents, and POSTs them to api[.]fivefingerz[.]dev under the /api/validate/files, /api/validate/system-info, and /api/validate/project-env endpoints.