The rust-testing-utils npm package version 2.3.0 masquerades as the pino logger by mimicking its README, keywords, and API. Its index.js exports middleware that spawns a detached child process running lib/caller.js. This script reconstructs a hardcoded URL by base64-decoding a value stored under a fake process.env variable. It fetches JavaScript code from this URL using axios, then executes the fetched code via the Function constructor with require passed as an argument, granting the remote code arbitrary execution and module-loading capabilities. The remote endpoint is attacker-controlled and mutable, enabling dynamic payload changes without package updates. The obfuscation techniques and impersonation strongly indicate a deliberate supply-chain compromise rather than legitimate functionality.

Consumers of rust-testing-utils version 2.3.0 are at risk of arbitrary code execution within their runtime environment. The malicious code can load any module and execute any commands with the privileges of the host process. Because the payload is fetched remotely and can be changed at any time by the attacker, the threat is persistent and can evolve without requiring new package versions. This compromises the integrity and security of any system using this package.

No official patch or remediation is currently documented. Users should immediately remove and stop using rust-testing-utils version 2.3.0. Avoid installing or deploying this package until a trusted, verified version is released. Monitor vendor advisories and trusted security sources for updates. Since the malicious payload is fetched remotely, network-level blocking of the indicated URL may provide temporary mitigation but does not replace removing the compromised package.