winston-prism@1.0.1

Analysis

winston-prism@1.0.1 is a combosquat of the winston logger that downloads and executes remote code. The file lib/winston_prisma/prismalogger.js contains an immediately-invoked async function that base64-decodes a hardcoded URL ("aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iLzJJRzZX" → hxxps://jsonkeeper[.]com/b/2IG6e), a header key ("eC1zZWNyZXQta2V5" → x-secret-key), and header value ("Xw==" → ]). It makes an HTTP GET to that URL with the custom header, extracts the "logger" field from the JSON response, compiles it via new Function.constructor("require", ...), and executes it with Node's require function — giving the remote payload full access to the filesystem, environment variables, and network. Retries up to 5 times on failure. The package impersonates the real winston logger (lists Charlie Robbins as author but is published by [account]).