notifier-utils@1.3.8

The package's main entry (index.js) exposes a middleware factory aliased as `pino`/default that, on first invocation, spawns a detached, unref'd `node lib/caller.js` child process. lib/caller.js issues an HTTP GET against https://jsonkeeper.com/b/HIOEN (an anonymous, author-mutable JSON-paste host) and passes the response body to `new Function.constructor("require", src)(require)`, executing arbitrary attacker-controlled JavaScript in the installer's Node process with access to `require`. Up to 5 retries are attempted. A second jsonkeeper URL (https://jsonkeeper.com/b/ZK45J) and an associated `x-secret-key: _` header are stored base64-encoded in lib/const.js as a fallback fetch target. The package name, keyword set, and lib/ layout (proto.js, redaction.js, multistream.js, transport.js, worker.js, meta.js reporting version '9.6.0') impersonate the legitimate `pino` logger to induce consumers to require it. Because the dropper fires from the main-module require path, any consumer that imports `notifier-utils` triggers arbitrary remote code execution controllable by the paste owner at any time. ## Source: ghsa-malware (380fd81aec6bb1bcbeb2b21bb7b91bfb8e4ca4e184d07885faa094da6b42c952) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.