notifier-log@1.3.5

Analysis

notifier-log is a combosquat of common logging package names. When required, index.js spawns a detached child process that runs lib/caller.js. That file fetches a remote payload from hxxps://jsonkeeper[.]com/b/EXSIF (with a custom x-secret-key header) and executes the response via new Function.constructor("require", payload), giving the remote server full access to Node.js require and the ability to run arbitrary code on the victim's machine.