The npm package @k.vict1999/pino-std-serializers is a malicious republish of a legitimate logging utility that includes an additional obfuscated module (lib/contract.js) which reconstructs and executes hidden code at runtime. Although the malicious payload is not triggered by default on install or require of the main entry point, the presence of this obfuscated code indicates a staged supply-chain attack potentially activating in future versions or through sibling modules.