Malicious code in pino-ulid (npm)
The npm package pino-ulid is named like a ULID generator, but it is a remote-access trojan. On install, its package.json postinstall script runs `node dist/node/utils.js` (after checking the dist files exist with existsSync). dist/node/utils.js writes a PID lock file, sets up persistence on Windows using schtasks and reg under the name `pkg-agent`, skips machines with fewer than 4 CPUs, and then starts dist/node/payload.js as a detached child process. dist/node/payload.js (about 456 KB, SHA-256 3a9089e9db3650dd6d1584fae709022002dc34854b961abfb014a90f0a7c6a50) is the agent. It connects to a hardcoded WebSocket command-and-control (C2) server. The C2 URL is hidden in dist/agent/config.js as a base64 string XORed with the 8-byte key [90,60,126,18,159,75,109,138], which decodes to ws://95.216.232.162:8010/ (HTTP form http://95.216.232.162:8010/, 15000 ms heartbeat). The agent sends a machine id and system info to the C2, reconnects if the link drops, and supports a `deploy_binary` command: the C2 sends base64 content that the agent writes to disk and runs, replacing itself and setting up persistence again. This gives the attacker remote code execution on the victim machine. The ULID name and description are just cover for the bundled agent that runs on install. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ade54621ac8726adc77fa29c4176808cdf82d0d1f8e45c2e051a17b1fd515779) pino-ulid impersonates the popular `pino` and `ulid` packages (home
MAL-2026-16154
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-16154
pino-ulid
Source reference: /affected/0/package/name
- Affected versions
- 2.12.3
Source reference:
/affected/0/versions3.0.1Source reference:
/affected/0/versions2.12.2Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "pino-ulid",
"purl": "pkg:npm/pino-ulid",
"ecosystem": "npm"
},
"versions": [
"2.12.3",
"3.0.1",
"2.12.2"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/pino-ulid/MAL-2026-16154.json",
"indicators": {
"evidence_files": [
{
"path": "package.json",
"tlsh": "4b612025cd980e331ac024d4e8ba5691e536885b89c4f958b3a9425d4fcc3af01ff2ed",
"sha256": "a81bb3f3339a740224fb53648604e7374e0b104f3993166d84a7cc277aed0439"
},
{
"path": "dist/node/payload.js",
"tlsh": "ffa4a44d6ef7111146a3b0b96faf9002b634d007250ced94bd9c93e46f8997c86f6be8",
"sha256": "3a9089e9db3650dd6d1584fae709022002dc34854b961abfb014a90f0a7c6a50"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "8b619cac7a316f1e94d80669ec6e8fd1c50faaf8",
"sha512_sri": "sha512-G1qz3x6yt0BU4NLk1yTrMsdB8hdtPw6RzzflABO/wS9dhBiJ5lKuf5OepyQNzl6whTBjdOafTXCWTRDbsppOUA=="
},
"filename": "pino-ulid-2.12.3.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #33438 · Revision 1
- Added to Heist Feed
- Publisher date