MAL-2026-4610 Malicious code in midcorp (npm)

The package masquerades as a pino-compatible logger (package.json keywords fast/logger/stream/json, exports module.exports.pino = middleware, lib filenames proto.js, redaction.js, multistream.js, transport.js, worker.js mirror pino's layout), but its actual runtime behavior is a remote-code-execution dropper. When a consumer requires midcorp and invokes the exported middleware() from index.js, a detached/unref'd child process spawns lib/caller.js, which performs axios.get against https://jsonkeeper.com/b/XRGF3 (an anonymous, mutable paste-bin host) and passes the returned data.cookie field to new Function.constructor('require', s)(require) — handing attacker-controlled JavaScript full Node.js require capabilities. The C2 URL is obfuscated as a base64 string disguised as a fake process.env.DEV_API_KEY default in lib/caller.js / lib/const.js (aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL1hSR0Yz → https://jsonkeeper.com/b/XRGF3), with a backup paste ID (4NAKK). The description field is unrelated boilerplate about vulnerability management. Three independent block signals (remote-eval of paste-bin content, pino impersonation cover, base64-hidden C2) leave no benign interpretation.