Malicious code in eth-pino (npm)

The eth-pino npm package version 2.0.3 includes a top-level asynchronous immediately-invoked function expression (IIFE) in lib/initializeCaller.js that decodes a base64-obfuscated URL and sends a shallow copy of the process environment variables to this remote endpoint via a POST request with a secret header. The response body is then executed as JavaScript code using new Function, passing the real require function, which allows the remote operator to execute arbitrary code within the Node.js process of the installer. The package is designed to evade static URL scanners by encoding the URL and mimics the legitimate pino logger package, exporting a no-op middleware consistent with typosquatting tactics.

This malicious package allows remote attackers to execute arbitrary code on systems that install or require eth-pino version 2.0.3, potentially leading to full compromise of the Node.js environment and exposure of environment variables. This can result in unauthorized access, data leakage, or further system compromise.

No official patch or remediation is currently documented. Users should avoid installing or using the eth-pino package version 2.0.3. Verify package authenticity before installation, prefer official packages, and remove any instances of eth-pino from projects. Monitor for updates from the package repository or vendor advisories for remediation guidance. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.