chain-chai-await

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (53dc585524bcc3e64a107006ba8c763591b071bb174c7acadd716b6e99ac1c34)
The package presents itself as a pino-compatible logger (exports `pino`, mirrors pino's lib/ layout with proto.js/redaction.js/transport.js/multistream.js/levels.js/time.js/symbols.js, and copies pino's defaultOptions shape) but has no relationship to the real pino package. When a consumer requires the package and invokes the exported middleware factory, index.js spawns lib/caller.js as a detached Node subprocess. caller.js performs an axios GET to https://jsonkeeper.com/b/K80JD, reads the `cookie` field from the JSON response, and executes it via `new Function.constructor("require", s)(require)` — arbitrary remote code execution in the consumer's Node process with full access to `require`. The fetch is retried up to 5 times. lib/const.js additionally stores a base64-encoded backup endpoint (aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL1pLNDVK → https://jsonkeeper.com/b/ZK45J) and base64-encoded header key/value (`x-secret-key`, `_`) used by the loader. The pino cover story, mirrored file layout, obfuscated backup URL, and remote-fetch-and-execute primitive against a public paste-like host are the fingerprint of a dropper disguised as a logging library.

Compromised versions (3)

• 1.3.6
• 1.3.7
• 1.3.5

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.