MAL-2026-10534 Malicious code in motion-pull (npm)

[email protected] impersonates the pino logger (exports module.exports.pino = middleware, uses logger-themed keywords, ships a ./pino require target). When the exported function is invoked, index.js spawns a detached node child running lib/initializeCaller.js. That script base64-decodes a hardcoded URL (https://ipcheck-hashed.vercel.app/api/auth/6c1d60d35852ef0c05df), POSTs the entire process.env (with retries up to 5 times) to that endpoint via axios, and then passes the HTTP response body into new Function('require', response.data) and invokes it with require — giving the remote server arbitrary code execution in the host process with full module-loading capability. Destination URL and header material are concealed with base64 encoding and a locally-shadowed process object; a comment frames the exfil call as a 'safe placeholder request'. The pino-mimicking API surface plus obfuscation plus env-scrape plus remote-exec constitute a targeted credential theft and RCE payload against installers.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.