Threats Tagged 'mal-2026-10156'

The [email protected] npm package impersonates the legitimate pino logger but contains malicious code that acts as a remote code dropper. On first use, it silently spawns a detached Node.js process that fetches attacker-controlled JavaScript from an anonymous JSON paste service and executes it with full module access. The package also uses base64-encoded fallback command-and-control endpoints and obfuscated headers to evade detection. This supply-chain attack enables arbitrary code execution in any application that loads and invokes this middleware.