Malicious code in pino-slite (npm)

The pino-slite package is a malicious npm package designed to impersonate the legitimate pino logger by mimicking its README and exported function. Upon requiring the package, it decodes and evaluates a base64-encoded payload that fetches and executes attacker-controlled JavaScript from a mutable third-party paste host. Before executing the remote code, it assembles a data object containing environment variables, platform, hostname, username, and MAC addresses, which the remote code can access to exfiltrate sensitive information such as CI secrets, AWS credentials, NPM tokens, and GitHub tokens. This combines a typosquatting lure with an import-time remote code execution and environment credential harvesting. The affected versions are exactly 4.1.12 and 4.1.16.

This malicious package enables remote code execution immediately upon import, allowing attackers to run arbitrary JavaScript code in the victim's environment. The attacker-controlled code can access and exfiltrate sensitive environment variables and host information, potentially compromising CI/CD secrets, cloud credentials, and developer tokens. This poses a significant risk of credential theft and further compromise of systems using these versions of pino-slite.

No official patch or remediation is currently documented. Users should immediately remove and avoid using the pino-slite package, especially versions 4.1.12 and 4.1.16. Verify dependencies to ensure the legitimate pino package is used instead. Monitor for any unauthorized access or credential misuse resulting from this package. Check vendor advisories or npm security advisories for updates or official remediation guidance.