Malicious code in pino-testkit (npm)

{
  "id": "1dc3b114de8c231bb17ff7c0bfc584b51321d29d706f11328e74c0b13bdd1da1",
  "url": "https://osv.dev/vulnerability/MAL-2026-16484",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in pino-testkit (npm)",
    "summary": "--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f2711bf14b5de8acc2d8a401de585d09de28c4dc674331f6578acbc9ea36c6e7) pino-testkit@10.4.5 impersonates the widely-used `pino` logger: package.json declares the name `pino-testkit` with pino's description, lists Matteo Collina as author and the real pino maintainers as contributors, and the README is a mechanical copy of pino's README with `pino` rewritten to `pino-testkit`. The shipped source is largely a copy of pino with an extra file `lib/contract.js` wired in. `pino.js` exports `chain`, whose body calls `contract()`, so `require('pino-testkit')(...)` reaches the added file at load/call time. `lib/contract.js` uses a deterministic Fisher-Yates-style shuffle plus character substitution (`\\x25`, `\\x23\\x30`, `\\x23\\x31`) to reconstruct the string `Function` and pluck `Function` off a captured global (`ype[OUN]`), then builds a new function from a second decoded body and immediately invokes it (`cMp(7746)`). Before doing so it hoists `require` and `module` onto `global`, so the dynamically constructed code can pull arbitrary further modules. Obfuscation of an executable payload combined with dynamic Function-constructor execution and require/module hoisting in a package that presents itself as `pino` is the canonical typosquat-dropper shape, giving the publisher arbitrary code execution on any consumer that requires or uses this package. ## Source: ghsa-malware (a263213f07071bf62a6f4fdb9c258b1e",
    "evidence": "osv:MAL-2026-16484",
    "products": [
      {
        "name": {
          "value": "pino-testkit",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "10.4.5",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-16484",
      "aliases": [
        "GHSA-9q39-547h-rfpc",
        "MAL-2026-16484"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                }
              ]
            }
          ],
          "package": {
            "name": "pino-testkit",
            "purl": "pkg:npm/pino-testkit",
            "ecosystem": "npm"
          },
          "versions": [
            "10.4.5"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/pino-testkit/MAL-2026-16484.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "lib/contract.js",
                  "tlsh": "22a16b125f9676bd58226287ed0e04058d3136fc63f4f0ae604ef5a158e634e433ecea",
                  "sha256": "c6a9028513792f288fec1d7c217c55d9541d96d436cb119ef0553c3fd49d6c41"
                },
                {
                  "path": "package.json",
                  "tlsh": "f4812321cc5d8dd31ac604ea78a955727a10850b8f58f85eb392531e4f8c43f62fa77d",
                  "sha256": "520c89c5752e78539ca97006f6735e766bb628318d30752b3fa0099af2a1153c"
                }
              ],
              "package_integrity": [
                {
                  "hashes": {
                    "sha1": "6d272092830f79a0b420377cf4220c593caa5a50",
                    "sha512_sri": "sha512-Dq1cqlJJAGhQBqrMmqUEpUufmYZNEttlyw6bG/Euh+u1B/WSDsyYwUez7vXbtRxZsF2HvTq6guFvkmq2lFm+sA=="
                  },
                  "filename": "pino-testkit-10.4.5.tgz"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-09T15:33:30.213095871Z",
      "provider": "osv",
      "references": [
        "https://www.npmjs.com/package/pino-testkit/v/10.4.5",
        "https://github.com/advisories/GHSA-9q39-547h-rfpc"
      ],
      "provider_metadata": {
        "malicious-packages-origins": [
          {
            "id": "IN-MAL-2026-020498",
            "sha256": "f2711bf14b5de8acc2d8a401de585d09de28c4dc674331f6578acbc9ea36c6e7",
            "source": "amazon-inspector",
            "versions": [
              "10.4.5"
            ],
            "import_time": "2026-09-23T22:16:59.163011402Z",
            "modified_time": "2026-09-23T22:11:20Z"
          },
          {
            "id": "GHSA-9q39-547h-rfpc",
            "ranges": [
              {
                "type": "SEMVER",
                "events": [
                  {
                    "introduced": "0"
                  }
                ]
              }
            ],
            "sha256": "a263213f07071bf62a6f4fdb9c258b1e3cf70735f006d9dd6e7407e4107a42ff",
            "source": "ghsa-malware",
            "import_time": "2026-10-09T15:26:20.35680521Z",
            "modified_time": "2026-10-09T15:00:30Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 121078,
  "published_at": "2026-09-23T22:11:20+00:00"
}