pinochiomathm (npm) · Malicious Code
Affects pinochiomathmSource GCVE Database
Rated by Threat Radar
Data as of 10 Sep 2026, 22:13 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmpinochiomathm | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Users should immediately remove and avoid using the 'pinochiomathm' package. Verify dependencies to ensure no malicious packages are included. Use trusted sources and package integrity verification mechanisms such as checksums or signatures. Monitor for suspicious network activity related to unexpected HTTP requests to unknown URLs during package installation.
Description
The npm package 'pinochiomathm' impersonates the legitimate 'picomatch' package and contains malicious code that enables arbitrary remote code execution. Upon requiring the package, it decodes and executes a payload fetched from a remote URL, decrypting it with a hardcoded AES-256-CBC key and executing it via eval(). The package employs evasion techniques such as disguising payload files as source map files, base64 and AES encryption, and removing staged payload files after execution to avoid detection.