ssr-auth-sync@1.6.16

Analysis

ssr-auth-sync@1.6.16 is a trojanized clone of the pino logger shipped under a misleading package name. When the package is imported, lib/writer.js executes immediately: it collects environment variables, hostname, platform, username, and MAC addresses, then fetches a second-stage payload from hxxps://www[.]jsonkeeper[.]com/b/PJNZP via axios and executes it via eval(), enabling full remote code execution. A backup C2 URL (hxxps://www[.]jsonkeeper[.]com/b/HY6M6) is also embedded. The harvested system data is passed to the second stage, which can exfiltrate credentials, tokens, or other sensitive information at the attacker's discretion.