VYPR
← All malware advisories

npm · Malicious package advisory

Malware

pino-std

MAL-2026-18692

Malicious code in pino-std (npm)

Details

pino-std ships lib/contract.js, byte-identical to the pino-testkit payload: a copy of the pino logger with an extra obfuscated module that decodes and evaluates code at load. It is a new name for the pino-testkit (MAL-2026-16484) campaign; the file hashes below match that record's evidence. The package presents itself as an ordinary utility, so the code runs on import or install without the user knowing.

Compromised versions (1)

  • 7.2.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.