The pino-debugging npm package is a malicious typosquat of the legitimate pino-debug package. It contains a backdoor that automatically runs attacker-controlled code when preloaded, connecting to a hardcoded command and control (C2) server to receive and execute payloads. The package uses obfuscated dependency renaming to evade detection. Versions 1.1.3 and 1.1.4 are affected. This is a supply chain attack vector that can compromise the security of systems that install and preload this package.