VYPR
← All malware advisories

npm · Malicious package advisory

Malware

loader-utils-kit

MAL-2026-18689

Malicious code in loader-utils-kit (npm)

Details

loader-utils-kit ships lib/contract.js, byte-identical to the pino-testkit payload: an obfuscated module that decodes and evaluates code at load. It is a new name for the pino-testkit (MAL-2026-16484) campaign; the file hashes below match that record's evidence. The package presents itself as an ordinary utility, so the code runs on import or install without the user knowing.

Compromised versions (2)

  • 4.2.1
  • 4.3.5

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.