0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
node-pino
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting node-pino, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-6762 | Unknown | Malicious code in node-pino (npm)node-pino is a one-edit typosquat of the popular `pino` logger that ships repackaged `winston` plus a malicious `postinstall` dropper. On `npm install`, the postinstall hook (`npm run license` -> `node lib/winston/license`) spawns a DETACHED, unref'd child process that reads an AES-256-CBC-encrypted blob (`license.list`, ~211 KB), decrypts it with a hardcoded key/iv, and `eval()`s the ~105 KB obfuscated infostealer payload. The stealer targets crypto wallets (exodus.wallet), the macOS Keychain, and Brave/Chrome/Edge user-data, zips the loot to `p5.zip`, and exfiltrates via HTTP POST /upload to |
| OSV (opens in a new tab) |
node-pino is a one-edit typosquat of the popular `pino` logger that ships repackaged `winston` plus a malicious `postinstall` dropper. On `npm install`, the postinstall hook (`npm run license` -> `node lib/winston/license`) spawns a DETACHED, unref'd child process that reads an AES-256-CBC-encrypted blob (`license.list`, ~211 KB), decrypts it with a hardcoded key/iv, and `eval()`s the ~105 KB obfuscated infostealer payload. The stealer targets crypto wallets (exodus.wallet), the macOS Keychain, and Brave/Chrome/Edge user-data, zips the loot to `p5.zip`, and exfiltrates via HTTP POST /upload to