If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
loader-utils-kit ships lib/contract.js, byte-identical to the pino-testkit payload: an obfuscated module that decodes and evaluates code at load. It is a new name for the pino-testkit (MAL-2026-16484) campaign; the file hashes below match that record's evidence. The package presents itself as an ordinary utility, so the code runs on import or install without the user knowing.