The pino-std npm package version 7.2.0 is a malicious package that impersonates the legitimate pino-std-serializers library. It includes an undocumented file, lib/contract.js, which reconstructs and executes obfuscated code at runtime. This code can load arbitrary modules, acting as a dormant second-stage loader. The malicious payload is not triggered on install or require by default but requires explicit import or execution of the hidden file.