If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (17bfab347de8288575bca9677b9eb7652b0024cdbffc1efebe387378c243299c)
The package presents itself as the popular `pino` logger (README badges, exported `module.exports.pino = middleware`) but its name and metadata are unrelated. When a consumer imports the package and invokes the default export as middleware, `index.js` spawns a detached `node` child running `lib/initializeCaller.js`. That child hides the C2 destination inside base64 constants placed in a fake local `process.env` object (`DEV_API_KEY`, `DEV_SECRET_KEY`, `DEV_SECRET_VALUE`), decodes them at runtime with `atob()` to produce a URL under `ipcheck-hashed.vercel.app/api/auth/...`, POSTs to it via axios, and passes the response body directly to `new Function('require', response.data)(require)`. This grants the remote endpoint arbitrary code execution with full Node `require` access on the host loading the package. The base64 obfuscation of the destination URL and the impersonation of a well-known logger are consistent with a dropper designed to compromise developer and build-system machines that install the package expecting `pino`.