cookie-phase@2.3.5

Analysis

Trojanized clone of the pino logger. When the module is imported, it spawns a detached background process that exfiltrates all environment variables (process.env) to a C2 endpoint at hxxps://ipcheck-hashed[.]vercel[.]app/api/auth/6c1d60d35852ef0c05df via HTTP POST, then executes the server's response as arbitrary JavaScript code using the Function constructor with access to require(), enabling full remote code execution on the victim's machine.