type-astr@3.2.3

Analysis

type-astr@3.2.3 is a trojanized clone of the pino logging library with an injected remote code execution payload. On require(), index.js spawns a detached background child process (child.unref()) running lib/caller.js. That script fetches a JSON payload from hxxps://jsonhosting[.]com/api/json/f1a66ab0/raw, extracts a "cookie" field from the response, and executes it as arbitrary JavaScript via the Function constructor with access to require(). The remote host controls the second-stage payload at runtime. The package has no repository URL and its description is unrelated to its actual behaviour.