pino-testkit (npm) · Malicious Code
Affects pino-testkitSource GCVE Database
Malicious package : remove pino-testkit and rotate any secrets on hosts that installed it.
Data as of 26 Oct 2026, 16:22 UTC
Malicious package
Published to npm · OSV MAL-2026-16484
What to do
Remove pino-testkit from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmpino-testkit | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The pino-testkit@10.4.5 npm package impersonates the legitimate pino logger by copying its metadata and README, but includes obfuscated malicious code. This code dynamically constructs and executes arbitrary functions, enabling arbitrary code execution when the package is required or used. This typosquatting package poses a risk of executing unauthorized code in consumers' environments.