The [email protected] package is a typosquatting malicious npm package that mimics the legitimate pino logger by copying its package.json metadata and README content. It includes an additional obfuscated file (lib/contract.js) that reconstructs the JavaScript Function constructor via character substitution and a deterministic shuffle, then dynamically builds and immediately invokes a function with arbitrary code. This function hoists require and module onto the global scope, allowing it to load arbitrary modules and execute arbitrary code. This behavior enables the attacker to execute arbitrary code on any system that requires or uses this package.

Any consumer that installs and requires [email protected] is at risk of arbitrary code execution due to the dynamically constructed and executed payload. This can lead to full compromise of the environment where the package is used.

No official patch or remediation is indicated. Consumers should avoid installing or using [email protected]. Verify dependencies to ensure the legitimate pino package is used and audit package names carefully to avoid typosquatting. Remove any instances of pino-testkit from projects and lockfiles.