Malicious code in node-pino (npm)

node-pino is a malicious npm package impersonating the popular pino logger. Upon installation, its postinstall hook runs a detached child process that decrypts an AES-256-CBC-encrypted payload embedded in the package. This payload is an obfuscated infostealer targeting exodus.wallet crypto wallets, macOS Keychain, and Brave/Chrome/Edge browser user data. The stolen information is zipped and exfiltrated via HTTP POST to a hardcoded C2 server on port 1224. The package's structure and targeting align with the DPRK-linked 'Contagious Interview' / BeaverTail npm campaign. The analysis was performed offline without executing the payload, so no live C2 or runtime artifacts were observed. The affected version is node-pino 2.3.2.

Any system that installs node-pino version 2.3.2 is fully compromised, as the package executes a malicious payload that steals sensitive credentials and user data. This includes crypto wallet keys, macOS Keychain secrets, and browser-stored information. The attacker gains persistent access through the exfiltration of this data, potentially leading to further compromise and data loss. Removal of the package alone does not guarantee eradication of all malicious artifacts or attacker presence.

No official patch or advisory is available for node-pino 2.3.2. Immediate removal of the package is recommended. However, because the system is considered fully compromised upon installation, all secrets and keys stored on the affected machine should be rotated from a separate, trusted device. Monitor for the presence of the postinstall script invoking 'npm run license' and the detached child process executing the decrypted payload as indicators of compromise. Avoid installing packages with suspicious or typo-squatted names and verify package authenticity before installation.