motion-pull@2.3.5

Analysis

motion-pull@2.3.5 is a combosquat impersonating the pino logger. On require(), it spawns a detached background Node.js process that decodes a base64-embedded C2 URL (hxxps://ipcheck-hashed[.]vercel[.]app/api/auth/6c1d60d35852ef0c05df), POSTs all environment variables (process.env) to that endpoint, then passes the server's response to new Function("require", response.data) — enabling arbitrary remote code execution on the installer's machine. The payload retries up to 5 times on failure.