🛡️ MAL-2026-7022 — tslint-conf

Malicious code in tslint-conf (npm)

Source: amazon-inspector

The package presents itself as the pino logger (README, index.d.ts, docs/, and lib/ files all reference pinojs/pino) but is published under the unrelated name tslint-conf. Its default export is an Express-style middleware factory whose invocation synchronously calls runJobA, which uses child_process.spawn("node", ["lib/caller.js",...], { detached: true, stdio: "ignore" }) followed by child.unref() to launch a hidden background worker. lib/caller.js performs axios.get against https://peach-eligible-penguin-917.mypinata.cloud/ipfs/bafkreigjnxn5vnn34rc5r43ajwwkmk4akqpm4awmq5gdhakgszpeqiffsu, takes the response body, and passes it to new Function.constructor("require", s) then invokes the resulting function with require, granting the fetched code full Node.js capabilities on the host. The remote content is attacker-controlled (Pinata account under the operator's control), unpinned by hash/signature, and executed unconditionally on every use of the middleware. Combined with the pino cover story, any consumer misled into using this package as their logger triggers remote code execution.

Source: ghsa-malware

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.