pino-deploy (npm) · Malicious Code
Affects pino-deploySource GCVE Database
Rated by Threat Radar
Data as of 21 Aug 2026, 14:28 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
npmpino-deploypkg:npm/pino-deployOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Remove the pino-deploy package immediately. Rotate all secrets and keys stored on the compromised system from a different, trusted computer. Because full system compromise is possible, consider a full system rebuild or forensic analysis to ensure removal of all malicious components. Check vendor or repository advisories for updates.
Description
The pino-deploy npm package versions 0.0.1, 0.0.2, and 1.0.0 contain malicious code. Any system with this package installed or running should be considered fully compromised, as the malicious code may have given an attacker full control. It is recommended to remove the package and immediately rotate all secrets and keys from a different, trusted system. However, removing the package may not fully eliminate the malicious presence on the system.