{
  "schema_version": "1.6.0",
  "id": "CLR-2026-2988",
  "modified": "2026-06-24T00:02:00Z",
  "published": "2026-06-24T00:02:00Z",
  "summary": "A multi-stage credential stealer hiding inside a fake “zod-pino” utility",
  "details": "The npm package zod-pino@1.0.127 posed as a simple integration of the popular zod and pino libraries. On install it silently bootstraps a persistent agent that harvests crypto wallets, browser credentials, Chromium extension databases, Discord tokens, the clipboard and secret files, and exfiltrates them to a hardcoded C2 relay plus Discord and HuggingFace. codelake captured the original artifact before it was pulled from the registry.",
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "zod-pino"
      },
      "versions": [
        "1.0.127"
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://research.codelake.dev/advisories/clr-2026-2988-zod-pino"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/MAL-2026-6273"
    }
  ],
  "credits": [
    {
      "name": "Sascha Klein, codelake Research",
      "type": "FINDER",
      "contact": [
        "https://research.codelake.dev"
      ]
    }
  ],
  "database_specific": {
    "caseId": "CLR-2026-2988",
    "kind": "malware",
    "severity": "Critical",
    "status": "Confirmed malicious",
    "iocs": {
      "ips": [
        "212.193.3.61"
      ],
      "hashes": [
        "sha256:b216b78cf665c4c48edebcf3e960a73632ce5056f336aea2f11afce845cf0499"
      ],
      "indicators": [
        "212.193.3.61:9877 (hardcoded relay — HTTP, validated routable)",
        "zod-pino@1.0.127 (npm) — removed; replaced by 0.0.1-security tombstone",
        "postinstall chain → …-bootstrap.mjs / …-agent.mjs (persistent agent via pm2 + autostart)",
        "Discord webhooks + HuggingFace Hub uploads (legitimate services abused as exfil channels)",
        "b216b78cf665c4c48edebcf3e960a73632ce5056f336aea2f11afce845cf0499 · zod-pino-1.0.127.tgz"
      ]
    }
  }
}