auth-next-gen@1.6.29

Analysis

Combosquat package impersonating authentication libraries. Ships a copy of the pino logger source as camouflage. The module's entry point loads lib/writer.js, which collects host fingerprinting data (all environment variables, operating system platform, hostname, username, and MAC addresses from network interfaces) and then fetches a remote payload from hxxps://www[.]jsonkeeper[.]com/b/PJNZP via the axios HTTP library and executes it with eval(), enabling arbitrary remote code execution. A secondary C2 URL (hxxps://www[.]jsonkeeper[.]com/b/HY6M6) is also hardcoded using hex encoding. The fetched payload operates in a closure with access to all collected environment variables, including any credentials or tokens present in the runtime.