pino-debugging (npm) · Malicious Code
Affects pino-debuggingSource GCVE Database
Malicious package : remove pino-debugging and rotate any secrets on hosts that installed it.
Data as of 26 Oct 2026, 15:55 UTC
Malicious package
Published to npm · OSV MAL-2026-6583
What to do
Remove pino-debugging from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmpino-debugging | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The pino-debugging npm package is a malicious typosquat of the legitimate pino-debug package. It contains a backdoor that automatically runs attacker-controlled code when preloaded, connecting to a hardcoded command and control (C2) server to receive and execute payloads. The package uses obfuscated dependency renaming to evade detection. Versions 1.1.3 and 1.1.4 are affected. This is a supply chain attack vector that can compromise the security of systems that install and preload this package.