pino-testkit

{"modified":"2026-09-23T22:11:20Z","published":"2026-09-23T22:11:20Z","schema_version":"1.7.4","id":"MAL-2026-16484","summary":"Malicious code in pino-testkit (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f2711bf14b5de8acc2d8a401de585d09de28c4dc674331f6578acbc9ea36c6e7)\npino-testkit@10.4.5 impersonates the widely-used `pino` logger: package.json declares the name `pino-testkit` with pino's description, lists Matteo Collina as author and the real pino maintainers as contributors, and the README is a mechanical copy of pino's README with `pino` rewritten to `pino-testkit`. The shipped source is largely a copy of pino with an extra file `lib/contract.js` wired in. `pino.js` exports `chain`, whose body calls `contract()`, so `require('pino-testkit')(...)` reaches the added file at load/call time. `lib/contract.js` uses a deterministic Fisher-Yates-style shuffle plus character substitution (`\\x25`, `\\x23\\x30`, `\\x23\\x31`) to reconstruct the string `Function` and pluck `Function` off a captured global (`ype[OUN]`), then builds a new function from a second decoded body and immediately invokes it (`cMp(7746)`). Before doing so it hoists `require` and `module` onto `global`, so the dynamically constructed code can pull arbitrary further modules. Obfuscation of an executable payload combined with dynamic Function-constructor execution and require/module hoisting in a package that presents itself as `pino` is the canonical typosquat-dropper shape, giving the publisher arbitrary code execution on any consumer that requires or uses this package.\n","affected":[{"package":{"ecosystem":"npm","name":"pino-testkit"},"versions":["10.4.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/contract.js","sha256":"c6a9028513792f288fec1d7c217c55d9541d96d436cb119ef0553c3fd49d6c41","tlsh":"22a16b125f9676bd58226287ed0e04058d3136fc63f4f0ae604ef5a158e634e433ecea"},{"path":"package.json","sha256":"520c89c5752e78539ca97006f6735e766bb628318d30752b3fa0099af2a1153c","tlsh":"f4812321cc5d8dd31ac604ea78a955727a10850b8f58f85eb392531e4f8c43f62fa77d"}],"package_integrity":[{"filename":"pino-testkit-10.4.5.tgz","hashes":{"sha1":"6d272092830f79a0b420377cf4220c593caa5a50","sha512_sri":"sha512-Dq1cqlJJAGhQBqrMmqUEpUufmYZNEttlyw6bG/Euh+u1B/WSDsyYwUez7vXbtRxZsF2HvTq6guFvkmq2lFm+sA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/pino-testkit/v/10.4.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020498","import_time":"2026-09-23T22:16:59.163011402Z","modified_time":"2026-09-23T22:11:20Z","sha256":"f2711bf14b5de8acc2d8a401de585d09de28c4dc674331f6578acbc9ea36c6e7","source":"amazon-inspector","versions":["10.4.5"]}]}}