Malicious code in loader-utils-kit (npm)

loader-utils-kit ships lib/contract.js, byte-identical to the pino-testkit payload: an obfuscated module that decodes and evaluates code at load. It is a new name for the pino-testkit MAL-2026-16484 campaign; the file hashes below match that record's evidence. The package presents itself as an...