type-swap@3.1.3

Analysis

type-swap@3.1.3 is a trojanized clone of the pino logger package. On require(), index.js spawns a detached child process running lib/caller.js. That script fetches attacker-controlled content from hxxps://jsonhosting[.]com/api/json/e16583b1/raw, extracts a "cookie" value from the JSON response, and executes it as arbitrary code via the Function constructor with access to Node.js require(). The remote payload can perform any action including credential theft, data exfiltration, or backdoor installation. The package's README is a verbatim copy of the legitimate pino logger documentation, but the package name and code are unrelated.