async-chain-dom@1.3.5

Analysis

Trojanized clone of the pino logger. When the package is required, index.js spawns a detached child process running lib/vcall.js, which fetches a remote payload from hxxps://api[.]jsonsilo[.]com/public/df71fd55-4f0c-4326-9b5b-a285e38023a5 and executes it via the Function constructor with the full require() scope passed in, giving the remote code full access to the filesystem and Node.js APIs. A secondary C2 domain (vercel-five-coral[.]vercel[.]app) is stored in a shipped .env file. The package has no lifecycle hooks — the payload runs on require(), not install.