stacknova@1.0.0

Analysis

stacknova@1.0.0 combosquats the pino logger library. When imported, package/lib/writer.js automatically executes: it reads all environment variables (including NPM_TOKEN, GITHUB_TOKEN, AWS credentials, etc.), collects the hostname, OS platform, username, and MAC addresses into a reconnaissance object; then silently installs the calcora package via `npm install calcora --no-warnings --no-save --no-progress --loglevel silent` and loads its pino.js file as a second-stage payload. The package bundles pino documentation as camouflage. The silent second-stage install enables arbitrary code execution on the victim's machine without consent.