MAL-2026-10074

The npm package testis-pack presents itself as a small binary packing/checksum utility (pack/unpack/checksum/inspect) but embeds an obfuscated dropper. It declares a preinstall: node index.js hook. The strings for the C2 host, path and dropped-binary name are not present in plaintext — they are reconstructed at runtime via String.fromCharCode() calls over hardcoded integer arrays, decoding to the host sloth-antagonist.vercel.app, path /service/assets/fetchBinary (Windows) or /service/assets/fetchLinuxBinary (Linux), and destination filenames WinService.exe (Windows) / WinMetrics (Linux) written into %LOCALAPPDATA%\Programs\WinMetrics or $HOME/.local/share/WinMetrics respectively — names chosen to masquerade as a legitimate Windows telemetry/service binary. When triggered, the code downloads the file from https://sloth-antagonist.vercel.app/service/assets/fetch(Linux)Binary, chmods it executable on Linux, then spawns it detached and unref'd (stdio: 'ignore', windowsHide: true on Windows) so it runs silently in the background, disconnected from the parent process. The routine is skipped on macOS.

Note on the trigger: unlike many install-hook droppers, the fetch-and-execute routine (_fetch()) is not invoked at the top level of index.js — there is no unconditional call anywhere in the module. It is instead called as the first statement inside the exported pack() function, so the bare node index.js invocation performed by the preinstall hook only defines and exports the functions without itself triggering the download. The dropper fires as a side effect the first time any downstream code calls the package's own pack() API — which is the package's entire ostensible purpose, making activation highly likely for any real consumer while still evading naive "executes immediately on install" detections. The package was published by npm user ioa2102 (anamora.les.24948@gmail.com), which also published the near-identical testudo-pack (same payload, postinstall hook instead of preinstall).

Analysis performed via static review only (npm registry metadata and package source retrieved as text via the npm registry and unpkg CDN) — the package was not installed or executed.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (96f8bc8284635b679a5ca943750a4d3386f73539e05352fd4cd6b0da5d01496f)

package.json declares a preinstall hook (node index.js) that runs automatically on npm install. index.js assembles the destination host, URL path, and dropped filename from String.fromCharCode numeric arrays to hide them from string scanners; the reconstructed values are the host sloth-antagonist.vercel.app and paths /service/assets/fetchBinary (Windows) and /service/assets/fetchLinuxBinary (Linux). The script downloads the unpinned, unverified binary via https.get(...).pipe(createWriteStream(dest)), writing it to %LOCALAPPDATA%\Programs\WinMetrics\WinService.exe on Windows or ~/.local/share/WinMetrics/WinMetrics on Linux — cover names that impersonate a Windows system component. The file is then chmod 0755ed and launched via spawn(dest, [], { detached: true, stdio: 'ignore', windowsHide: true }).unref(), so it survives the install process and runs silently in the background under the installing user's privileges. The exported pack() API triggers the same fetch-and-execute path on any call, so require('testis-pack') also delivers the payload. The dropped bytes are attacker-controlled and mutable at the host, giving the publisher open-ended remote code execution on every installer's machine.