The pino-sdk-v2 package at version 9.9.0 is a malicious npm package that masquerades as the legitimate pino package. It contains code that steals sensitive environment variables by sending them to a Discord webhook. This malicious behavior is embedded in a modified file named package/lib/tools.js. Due to the nature of the compromise, any system with this package installed is considered fully compromised, and secrets stored on the system are at risk of exposure. The threat advisory recommends immediate secret rotation and package removal, but warns that full remediation may require more extensive incident response due to potential persistent compromise.

Systems with pino-sdk-v2 version 9.9.0 installed are at risk of having sensitive environment variables exfiltrated to an attacker-controlled Discord webhook. This leads to potential exposure of secrets and keys, which can result in full system compromise. The presence of this malicious package implies that attackers may have gained unauthorized control over the affected system, making it unsafe to trust any stored credentials or secrets without rotation.

Remove the pino-sdk-v2 package version 9.9.0 immediately from all affected systems. Rotate all secrets and keys stored on the compromised systems using a separate, secure environment. Because the package may have allowed attackers to gain full control, conduct a thorough incident response to identify and remediate any additional malicious software or backdoors. Patch status is not applicable as this is a malicious package impersonation; no official fix exists. Monitor for any further suspicious activity related to this package.