pretty-fancy@1.0.1

Analysis

The package masquerades as a logger utility; dist/index.js requires dist/logger.js, a javascript-obfuscator-packed module that runs malicious code when imported. On execution it reads host details via os.networkInterfaces()/homedir and POSTs them to hxxps://logger[.]clob[.]health/api/validate/system-info, then harvests project secrets by reading .env, .json and SvelteKit (svelte-kit) project files and exfiltrating them to hxxps://logger[.]clob[.]health/api/validate/project-env and hxxps://logger[.]clob[.]health/api/validate/files (HTTP POST, content-type application/json; a socket[.]io channel is also used). For persistence it appends a hardcoded attacker SSH public key (ssh-rsa AAAAB3...== user@DESKTOP-4TO2VRJ) to the user's ~/.ssh/authorized_keys (writeFileSync + chmodSync), installing an SSH backdoor. C2 host: logger.clob.health.