pino-std@7.2.0

Analysis

pino-std@7.2.0 is a trojanized clone of the pino-std-serializers package. Its package.json, index.js, lib/err.js, lib/req.js, lib/res.js, Readme.md and test suite are copied from the upstream project, but the tarball also ships an extra file, lib/contract.js, that is not part of the upstream source and is not referenced by index.js. lib/contract.js is a hand-written obfuscated loader: a character-table permutation routine decodes the identifiers "e", "object" and "m" from the string "e%objrct%m" and then assigns global["e"] = require and global["object"] = module, exposing require/module on the global object. A second decoder rebuilds a roughly 4 KB JavaScript source string from a shuffled character pool and executes it with the Function constructor (the decoded string is passed as the function body and invoked immediately). The executed code is assembled at runtime and never appears as a readable string in the package, so the payload is not visible in the published files. The package declares no install or postinstall hook, no bin entries and no runtime dependencies, so nothing executes during installation; the loader is reachable when a consumer requires the package. The package name pino-std is a combosquat of the real pino-std-serializers, and the manifest still carries the upstream author while the publishing account is different. No network indicator (host, IP or URL) is present in the readable portion of the package.