registry / pino-testkit / 10.4.5

pino-testkit@10.4.5

super fast, all natural json logger

AI Security Review

scanned 13d ago · by lpm-firewall-ai

The published entrypoint replaces the expected logger export with a function that runs an opaque contract payload. The payload reconstructs and executes concealed code.

Static reason

One or more suspicious static signals were detected.

Trigger

Calling the package's exported main function.

Impact

The concealed executable behavior prevents safe verification and can perform arbitrary actions in the caller process.

Mechanism

The entrypoint calls lib/contract.js, which uses string permutation and dynamically created functions to run concealed source.

Attack narrative

The package entrypoint loads an obfuscated contract module and exports a wrapper that calls it. That module reconstructs hidden strings, creates callable code, and invokes it. This active opaque execution is unrelated to normal logging behavior and hides its effective actions from source review.

AI rationale

The main callable path reaches deliberately concealed dynamically constructed code. This is concrete active malicious behavior, even though the concealed payload's final actions are not statically recoverable from the inspected bytes.

Evidence

pino.jslib/contract.js

OSV advisory

OpenSSF/OSV

Advisory

MAL-2026-16484

Source

OpenSSF Malicious Packages via OSV

Summary

pino-testkit@10.4.5

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code