notifier-utils@1.3.7

Analysis

notifier-utils@1.3.7 is a trojanized install that fetches and executes arbitrary remote code. When the exported middleware function is called, index.js spawns a detached background node process (stdio:ignore, unref'd) running lib/caller.js. That script uses axios to GET a payload from hxxps://jsonkeeper[.]com/b/BPB86 (with a custom "x-secret-key" header), then compiles and runs it via new Function.constructor("require", src) — granting the fetched code full Node.js module access. The payload URL is attacker-controlled and can be changed at any time to deliver arbitrary second-stage commands. The package ships cloned pino logger documentation as camouflage and has no real functionality of its own.