zod-pino434@1.0.128

Analysis

Combosquat package impersonating the popular zod and pino libraries. On npm install, the postinstall chain (5 scripts) deploys a persistent remote access trojan: it spawns a detached background Node.js agent process, copies itself to a hidden durable runtime directory under ~/.forge-jsxy/runtime/, registers OS autostart for persistence across reboots, and connects via WebSocket to a remote C2 host (decrypted from AES-256-GCM encrypted configuration at runtime). The agent provides full file system read/write access, clipboard monitoring, secret/credential scanning, Discord webhook/screenshot capabilities, and remote control via WebRTC. The package has no repository and no verifiable publisher identity.