web-pop@2.3.5

Analysis

Package web-pop is a trojanized clone of the pino logger library. It ships a dormant remote code execution backdoor in lib/initializeCaller.js. The file contains a self-executing function that: (1) decodes a hardcoded base64 C2 URL (hxxps://ipcheck-hashed[.]vercel[.]app/api/auth/6c1d60d35852ef0c05df), (2) POSTs the entire process environment variables to that endpoint, and (3) executes the server's response as arbitrary JavaScript via new Function("require", response.data)(require), giving the C2 full remote code execution on the victim's machine. The payload is currently dormant (not wired into the main entry point) but is present in the package and could be activated by a future update or by any code path that loads the file.