{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "lib/contract.js",
              "sha256": "c6a9028513792f288fec1d7c217c55d9541d96d436cb119ef0553c3fd49d6c41",
              "tlsh": "22a16b125f9676bd58226287ed0e04058d3136fc63f4f0ae604ef5a158e634e433ecea"
            },
            {
              "path": "package.json",
              "sha256": "520c89c5752e78539ca97006f6735e766bb628318d30752b3fa0099af2a1153c",
              "tlsh": "f4812321cc5d8dd31ac604ea78a955727a10850b8f58f85eb392531e4f8c43f62fa77d"
            }
          ],
          "package_integrity": [
            {
              "filename": "pino-testkit-10.4.5.tgz",
              "hashes": {
                "sha1": "6d272092830f79a0b420377cf4220c593caa5a50",
                "sha512_sri": "sha512-Dq1cqlJJAGhQBqrMmqUEpUufmYZNEttlyw6bG/Euh+u1B/WSDsyYwUez7vXbtRxZsF2HvTq6guFvkmq2lFm+sA=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "pino-testkit"
      },
      "versions": [
        "10.4.5"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-020498",
        "import_time": "2026-09-23T22:16:59.163011402Z",
        "modified_time": "2026-09-23T22:11:20Z",
        "sha256": "f2711bf14b5de8acc2d8a401de585d09de28c4dc674331f6578acbc9ea36c6e7",
        "source": "amazon-inspector",
        "versions": [
          "10.4.5"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f2711bf14b5de8acc2d8a401de585d09de28c4dc674331f6578acbc9ea36c6e7)\npino-testkit@10.4.5 impersonates the widely-used `pino` logger: package.json declares the name `pino-testkit` with pino\u0027s description, lists Matteo Collina as author and the real pino maintainers as contributors, and the README is a mechanical copy of pino\u0027s README with `pino` rewritten to `pino-testkit`. The shipped source is largely a copy of pino with an extra file `lib/contract.js` wired in. `pino.js` exports `chain`, whose body calls `contract()`, so `require(\u0027pino-testkit\u0027)(...)` reaches the added file at load/call time. `lib/contract.js` uses a deterministic Fisher-Yates-style shuffle plus character substitution (`\\x25`, `\\x23\\x30`, `\\x23\\x31`) to reconstruct the string `Function` and pluck `Function` off a captured global (`ype[OUN]`), then builds a new function from a second decoded body and immediately invokes it (`cMp(7746)`). Before doing so it hoists `require` and `module` onto `global`, so the dynamically constructed code can pull arbitrary further modules. Obfuscation of an executable payload combined with dynamic Function-constructor execution and require/module hoisting in a package that presents itself as `pino` is the canonical typosquat-dropper shape, giving the publisher arbitrary code execution on any consumer that requires or uses this package.\n",
  "id": "MAL-2026-16484",
  "modified": "2026-09-23T22:11:20Z",
  "published": "2026-09-23T22:11:20Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/pino-testkit/v/10.4.5"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in pino-testkit (npm)"
}