{"id":"MAL-2026-18692","kind":"package","aliases":["MAL-2026-18692"],"related":[],"title":"Malicious code in pino-std (npm)","description":"pino-std ships lib/contract.js, byte-identical to the pino-testkit payload: a copy of the pino logger with an extra obfuscated module that decodes and evaluates code at load. It is a new name for the pino-testkit (MAL-2026-16484) campaign; the file hashes below match that record's evidence. The package presents itself as an ordinary utility, so the code runs on import or install without the user knowing.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"pino-std","fixed":[],"affected":"= 7.2.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-26T00:00:00+00:00","first_seen_at":"2026-11-05T06:31:45+00:00","triaged_at":"2026-11-05T06:32:52+00:00","updated_at":"2026-11-05T06:32:52+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-16484':63C '-18692':10A,13A '-2026':9A,12A,62C 'byte':25C 'byte-ident':24C 'campaign':64C 'code':2A,48C,84C 'copi':34C 'decod':45C 'evalu':47C 'evid':73C 'extra':41C 'file':66C 'hash':67C 'ident':26C 'import':87C 'instal':89C 'know':93C 'lib/contract.js':23C 'load':50C 'logger':38C 'mal':8A,11A,61C 'malici':1A,17B 'match':69C 'modul':43C 'name':55C 'new':54C 'npm':7A 'obfusc':42C 'ordinari':80C 'packag':18B,75C 'payload':32C 'pino':5A,15A,20C,30C,37C,59C 'pino-std':4A,14A,19C 'pino-testkit':29C,58C 'present':76C 'record':71C 'run':85C 'ship':22C 'std':6A,16A,21C 'testkit':31C,60C 'user':92C 'util':81C 'without':90C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["pinostd"],"ptokens":["pino","std"],"labels":["critical","malicious","npm","package"],"campaign_type":null,"first_public_at":"2026-10-26T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18692","url":"https://osv.dev/vulnerability/MAL-2026-18692","severity":"critical","published_at":"2026-10-26T00:00:00+00:00","modified_at":"2026-11-05T05:15:05+00:00","first_seen_at":"2026-11-05T06:31:45+00:00","fetched_at":"2026-11-05T06:31:45+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}