notify-logs@1.3.5

Analysis

notify-logs@1.3.5 is a trojanized clone of the pino logging library. The package ships a copy of pino's source code but replaces the entry point so that when the module is required, it spawns a detached, hidden background Node.js process. That process fetches arbitrary JavaScript code from hxxps://jsonkeeper[.]com/b/EXSIF via an HTTP GET request (with headers x-secret-key: _) and executes the response's "cookie" field using Function constructor, giving the remote payload unrestricted access to Node.js require() and full system-level capabilities. The downloaded code can perform any action — credential theft, file exfiltration, additional payload download, or persistence — without the installer's awareness, since the child process runs silently with detached stdio.