The pretty-pino-logger package distributed via npm in versions =1.0.0 through =1.0.4 and =2.0.1 through =2.0.2 contains embedded malicious code. Installation or execution of these versions results in a full compromise of the host system, potentially allowing an attacker to gain complete control. Due to the severity of the compromise, all secrets and keys on the affected system should be rotated from a secure environment. The package removal does not assure full remediation as the attacker may have installed additional persistent malware.

Full system compromise on any computer with the affected versions of pretty-pino-logger installed or running. This includes potential unauthorized access to all stored secrets and keys. The malicious code may allow attackers to maintain persistent control beyond the presence of the package itself.

Remove the affected pretty-pino-logger package versions from all systems. Immediately rotate all secrets and keys stored on the compromised systems from a separate, trusted environment. Because the system is considered fully compromised, further forensic analysis and remediation may be necessary to ensure all malicious artifacts are removed. No official patch or fixed version is indicated; therefore, avoidance of these versions is critical.