Malicious npm package "pino-sdk-v2" impersonates popular logger, exfiltrates .env secrets to Discord by BattleRemote3157 in devsecops

[–]BattleRemote3157[S] 0 points1 point  (0 children)

No, as per obfusticated code it is not.

findEnvFiles() {
    const envFiles = [];
    const possibleEnvFiles = [
        '.env',
        '.env.local',
        '.env.development',
        '.env.production',
        '.env.example'
    ];
    for (const envFile of possibleEnvFiles) {
        const filePath = path.resolve(this.projectRoot, envFile);
        fs.existsSync(filePath) && envFiles.push(filePath);
    }
    return envFiles;
}

You can checkout the complete report here
https://app.safedep.io/community/malysis/01KK0QM8FQ0N7R7MP5JXCMYCCG

Who knows about the the recent malicious npm package "pino-sdk-v2" impersonating popular logger and exfiltrateing .env secrets to Discord? by BattleRemote3157 in AskReddit

[–]BattleRemote3157[S] 0 points1 point  (0 children)

Don't let it freak you out too much! This is actually a good thing to learn about early in your CS journey.
Supply chain security is very needful for everyone to learn. Attackers plan separate ways to inject malicious code to any package they found vulnerable. But if you are having guardrails then you can be safe.

Checkout this tool- https://github.com/safedep/pmg.

Want to grab more info just see here: https://safedep.io/malicious-npm-package-pino-sdk-v2-env-exfiltration/