pretty-pino-logger@2.0.2

Analysis

A credential-stealing backdoor combosquatting pino-pretty and posing as a colorized logger. On require(), dist/logger.js immediately fingerprints the host (platform, IP address(es), username); on Linux writes a hardcoded ssh-rsa public key into ~/.ssh/authorized_keys for persistent SSH access; recursively walks the filesystem (home dirs, /home on Linux, drive roots on Windows, /Users on macOS) collecting .env and .json files while skipping node_modules; and exfiltrates the collected data via HTTP POST to logger.clob[.]health — system info to /api/validate/system-info, scraped env/json files to /api/validate/files, and the project-local .env to /api/validate/project-env. The exposed dist/index.js exports a harmless Logger class as a decoy.