The pino-debugging package is a malicious typosquatting package targeting users of the legitimate pino-debug npm package. It ships with an index.js that requires a dependency named 'loadutils' and invokes it on preload, causing the attacker's code to run automatically. The package contains a backdoor that connects to https://fundraiser-success.vercel.app to receive and execute remote payloads, controlled via environment variables DEBUG_C2_SERVER, DEBUG_C2_PROTOCOL, and DEBUG_VERBOSE. The dependency was renamed from previously documented malicious chains to evade name-based detection. Installing and preloading pino-debugging versions 1.1.3 and 1.1.4 results in execution of attacker-controlled code and beaconing to a hardcoded C2 server, representing a critical supply chain compromise.

Systems that install and preload pino-debugging versions 1.1.3 or 1.1.4 will execute attacker-controlled code automatically, potentially allowing remote code execution and persistent backdoor access. This compromises the integrity and confidentiality of affected systems and can lead to further malicious activity controlled by the attacker.

Avoid installing or preloading the pino-debugging package, especially versions 1.1.3 and 1.1.4. Since this is a malicious typosquat package, replace any usage with the legitimate pino-debug package. There is no official patch or fix for pino-debugging as it is a malicious package; remediation involves removing it from dependencies and lockfiles. Monitor dependency trees for typosquat or suspicious packages to prevent supply chain attacks.