Malicious code in pinno-loggers (npm)
pinno-loggers is a malicious npm package that depends on terminal-logger-utils and executes a multi-stage malware payload via postinstall hooks. The second-stage binary provides keylogger, infostealer, and RAT capabilities, stealing sensitive data including credentials, SSH keys, and crypto wallets.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed or imported the pinno-loggers package
- Ecosystems
- Attack vectors
- Affected entities
- pinno-loggersMalicious npm package with dependency on terminal-logger-utils
pinno-loggers is a malicious npm package discovered in the OpenSSF malicious packages repository. The package depends on terminal-logger-utils, which contains the primary malicious payload.
Upon installation or import, a postinstall hook is triggered that executes utils.cjs, an obfuscated malware dropper. This dropper downloads and executes a platform-specific second-stage binary hosted on Hugging Face.
The second-stage payload provides keylogger, infostealer, and remote access trojan (RAT) functionality. It exfiltrates sensitive local data including Telegram Desktop sessions, browser login databases, cryptocurrency wallets, SSH keys, cloud configurations, environment variables, and files matching specific keywords. The malware establishes a connection to a remote command-and-control server for full machine control.
This incident was identified and credited to the OpenSSF malicious packages project.
Indicators of compromise
- Packages
- pinno-loggers
- terminal-logger-utils
Remediation
- Immediately uninstall pinno-loggers and terminal-logger-utils from all systems
- Audit npm package.json and lock files for presence of these packages across all projects
- Regenerate all sensitive credentials including SSH keys, API tokens, and cloud credentials
- Scan systems for indicators of compromise including network connections to unknown C2 servers
- Review browser login databases and cryptocurrency wallet access logs for unauthorized activity
- Check Telegram Desktop and other messaging applications for unauthorized access
- Monitor for suspicious postinstall hook execution in npm audit logs
- Use npm audit to identify any remaining malicious dependencies
- Consider using npm package signing verification and supply chain security tools
Sources
- GitHub Advisory GHSA-hxwm-gvm7-fq2q · GitHub Advisory Database
Cite this entry
"Malicious code in pinno-loggers (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 27, 2026. https://supplychainattack.org/incident/malicious-code-in-pinno-loggers-npm-11x34i
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in sme-rko-finance-front-payments-allowed-tariffs-filter (npm)
The npm package sme-rko-finance-front-payments-allowed-tariffs-filter contains malicious code that downloads and executes arbitrary binaries from attacker-controlled Cloudflare Workers and Russian DNS fallback hosts upon installation or import. The package masquerades as a finance UI component but performs full-host code execution with no verification or configuration controls.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in sme-rko-finance-front-operations-income (npm)
The npm package sme-rko-finance-front-operations-income contained malicious code that downloads and executes platform-specific native binaries on package import. The package was disguised as a monitoring/observability SDK but contained no legitimate functionality.
npmCompromised packageMalicious commit - containedcritical
Malicious code in sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-impl (npm)
The npm package sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-impl contains malicious code that downloads and executes unsigned native binaries from Cloudflare Workers subdomains and a .ru fallback domain. The attack is disguised as telemetry/analytics functionality with opt-out environment variables.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in delivery-ci-codeceptjs-fork (npm)
The npm package delivery-ci-codeceptjs-fork contained malicious code that executed remote code on installation/require. The dropper reconstructed attacker-controlled hostnames, downloaded platform-specific binaries, and spawned them with detached shell execution, with a DNS-TXT covert-channel fallback.
npmCompromised packageMalicious commit