pino-sdk-v2 Discord webhook env stealer

SafeDep: pino logger impersonation hiding obfuscated code inside a
legitimate-looking library file, stealing environment secrets to a
Discord webhook.

Mapped techniques

T0136 Brandjacking
T0140 Harvest tokens from environment variables
T0156 Exfiltration over webhooks

supply-chain campaign

T0136 · Initial Access · Brandjacking

pino impersonation.

T0140 · Credential Access · Harvest tokens from environment variables

Env secret theft.

T0156 · Exfiltration · Exfiltration over webhooks

Discord webhook exfil.

Sources

https://safedep.io/malicious-npm-package-pino-sdk-v2-env-exfiltration