prettlog@1.0.10

Analysis

prettlog@1.0.10 poses as a logging library but contains a credential-harvesting implant. Its dist/index.js embeds a C2 endpoint (89[.]116[.]23[.]67:9001/poly) and when logger[.]info() is called, it scans the filesystem — including /, /root, /home, /var/www, /etc, /opt — for .env and .json files, reads them, base64-encodes their contents, and uploads them to the C2 via axios with up to 80 concurrent connections. It also writes to /root/.ssh/authorized_keys (SSH persistence). The postinstall hook is a decoy (just a comment); the real payload runs at runtime when the logger is used. The publisher ([account]