The pino-formatter package (versions 1.1.12 and 1.1.13) is a malicious npm package that pretends to be a pino-pretty-style logger but executes harmful actions when imported. On Linux systems, it adds a hardcoded SSH ed25519 public key to ~/.ssh/authorized_keys, granting attackers persistent remote SSH access. It recursively scans user home directories and common system paths to collect environment, document, and configuration files, encoding some in base64, and exfiltrates them via HTTP POST requests to a remote API endpoint. It also harvests project-specific environment and configuration files related to Polymarket/CLOB trading clients and sends system metadata including OS, IP, and username to the attacker’s server. This behavior effectively compromises the host system and exposes sensitive data.

Any system with pino-formatter versions 1.1.12 or 1.1.13 installed or running is fully compromised. The attacker gains persistent remote SSH access on Linux hosts and exfiltrates sensitive files and environment configurations, potentially exposing secrets, credentials, and private data. This level of compromise means all secrets and keys stored on the affected machine should be considered exposed and rotated immediately. Removing the package alone may not fully remediate the compromise due to potential additional malware installed by the attacker.

No official patch or fix is available for this malicious package. Immediate removal of pino-formatter versions 1.1.12 and 1.1.13 is required. Systems suspected of having this package installed should be treated as fully compromised. All secrets, keys, and credentials stored on the affected machines must be rotated from a secure, uncompromised environment. A full incident response and forensic investigation is recommended to identify and remediate any additional persistence mechanisms or malware installed by the attacker.