pino-testkit

GHSA-q57p-68r4-fj72

Malicious code in pino-testkit (npm)

Details

**Severity:** Critical

**Affected versions:** `= 10.4.5`

## Source: amazon-inspector (f2711bf14b5de8acc2d8a401de585d09de28c4dc674331f6578acbc9ea36c6e7)
[email protected] impersonates the widely-used `pino` logger: package.json declares the name `pino-testkit` with pino's description, lists Matteo Collina as author and the real pino maintainers as contributors, and the README is a mechanical copy of pino's README with `pino` rewritten to `pino-testkit`. The shipped source is largely a copy of pino with an extra file `lib/contract.js` wired in. `pino.js` exports `chain`, whose body calls `contract()`, so `require('pino-testkit')(...)` reaches the added file at load/call time. `lib/contract.js` uses a deterministic Fisher-Yates-style shuffle plus character substitution (`\x25`, `\x23\x30`, `\x23\x31`) to reconstruct the string `Function` and pluck `Function` off a captured global (`ype[OUN]`), then builds a new function from a second decoded body and immediately invokes it (`cMp(7746)`). Before doing so it hoists `require` and `module` onto `global`, so the dynamically constructed code can pull arbitrary further modules. Obfuscation of an executable payload combined with dynamic Function-constructor execution and require/module hoisting in a package that presents itself as `pino` is the canonical typosquat-dropper shape, giving the publisher arbitrary code execution on any consumer that requires or uses this package.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/83ae288c0e1b4c3af86970a251204044347e7e31/osv/malicious/npm/pino-testkit/MAL-2026-16484.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/83ae288c0e1b4c3af86970a251204044347e7e31/osv/malicious/npm/pino-testkit/MAL-2026-16484.json
- https://www.npmjs.com/package/pino-testkit/v/10.4.5
- https://github.com/advisories/GHSA-q57p-68r4-fj72

Compromised versions (1)

= 10.4.5

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.