type-atob@3.3.7

Analysis

type-atob@3.3.7 is a trojanized clone of the pino logger library that downloads and executes arbitrary remote code. When the package's middleware export is called, it spawns a detached Node.js child process that fetches code from hxxps://json[.]extendsclass[.]com/bin/49b93b00acf1 via an HTTP GET request and executes it using the Function constructor. The C2 host is json[.]extendsclass[.]com and the specific resource path is /bin/49b93b00acf1. The fetched payload is passed to new Function("require", payload) and immediately invoked, giving the attacker full control over the Node.js runtime environment.