npm · Malicious package advisory
Malware@k.vict1999/pino-std-serializers
MAL-2026-18677
Malicious code in @k.vict1999/pino-std-serializers (npm)
Details
@k.vict1999/pino-std-serializers ships lib/contract.js, byte-identical to the pino-testkit payload: an obfuscated module that decodes and evaluates code at load. It is a new name for the pino-testkit (MAL-2026-16484) campaign; the file hashes below match that record's evidence. The package presents itself as an ordinary utility, so the code runs on import or install without the user knowing.
Compromised versions (1)
- 7.2.0
Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.