MalwarePublished 26 Oct 2026Updated 13 Nov 2026

@k.vict1999/pino-std-serializers (npm) · Malicious Code

Affects @k.vict1999/pino-std-serializersSource GCVE Database

Malicious package : remove @k.vict1999/pino-std-serializers and rotate any secrets on hosts that installed it.

Data as of 13 Nov 2026, 04:29 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18677

What to do

Remove @k.vict1999/pino-std-serializers from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@k.vict1999/pino-std-serializers	Affected =7.2.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @k.vict1999/pino-std-serializers is a malicious republish of a legitimate logging utility that includes an additional obfuscated module (lib/contract.js) which reconstructs and executes hidden code at runtime. Although the malicious payload is not triggered by default on install or require of the main entry point, the presence of this obfuscated code indicates a staged supply-chain attack potentially activating in future versions or through sibling modules.

Impact

If the obfuscated payload in lib/contract.js is executed, it could run arbitrary code on the host environment, potentially compromising system integrity and security. Currently, the payload is dormant as it is not triggered by default usage, but future versions or sibling modules could activate it, posing a supply-chain risk to projects depending on this package.

Defensive guidance

Users should avoid installing or using the @k.vict1999/pino-std-serializers package. Since the malicious code is not triggered by default, no immediate execution occurs on install or require of the documented entry point. However, due to the supply-chain risk, users should remove this package if present and rely only on the official pinojs/pino-std-serializers package from trusted sources. Monitor for vendor advisories or security community updates for further remediation guidance.

Summary

@k.vict1999/pino-std-serializers repackages the legitimate pinojs/pino-std-serializers package but adds a new file, lib/contract.js, containing obfuscated code that decodes and executes a hidden payload using the Function constructor. This file is not invoked by the main entry point or install lifecycle hooks, so the payload does not run immediately. The package appears to be part of a supply-chain malware campaign, reusing the pino-testkit payload under a new package name and scope. The obfuscation and staging suggest the package is designed to lure users into installing it before activating malicious behavior.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 13 Nov 2026, 04:29 UTC

Technical details

References

Community reviews