OpenSSF/OSV advisory MAL-2026-4196 confirms this npm version as malicious. pinno-loggers is a malicious npm package that depends on terminal-logger-utils and triggers the malicious behavior in that package when installed or imported.
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in pinno-loggers (npm)
Details
pinno-loggers is a malicious npm package that depends on terminal-logger-utils and triggers the malicious behavior in that package when installed or imported.
The terminal-logger-utils payload executes a postinstall hook that opens utils.cjs, an obfuscated malware dropper. The dropper downloads and runs a platform-specific second-stage binary from Hugging Face. The second-stage payload provides keylogger, infostealer, and RAT behavior, steals sensitive local data including Telegram Desktop sessions, browser login databases, crypto wallets, SSH keys, cloud configurations, environment variables, and keyword-matched files, and connects to a remote server for full machine control.
Decision reason
OpenSSF Malicious Packages via OSV confirms pinno-loggers@1.0.0 as malicious (MAL-2026-4196): Malicious code in pinno-loggers (npm)