MAL-2026-10075

The npm package testudo-pack is byte-for-byte identical (verified via diff) to testis-pack from the same npm publisher ioa2102 (anamora.les.24948@gmail.com), differing only in its install hook: postinstall: node index.js instead of preinstall. It presents itself as a small binary packing/checksum utility (pack/unpack/checksum/inspect) but embeds an obfuscated dropper. The strings for the C2 host, path and dropped-binary name are not present in plaintext — they are reconstructed at runtime via String.fromCharCode() calls over hardcoded integer arrays, decoding to the host sloth-antagonist.vercel.app, path /service/assets/fetchBinary (Windows) or /service/assets/fetchLinuxBinary (Linux), and destination filenames WinService.exe (Windows) / WinMetrics (Linux) written into %LOCALAPPDATA%\Programs\WinMetrics or $HOME/.local/share/WinMetrics respectively — names chosen to masquerade as a legitimate Windows telemetry/service binary. When triggered, the code downloads the file from https://sloth-antagonist.vercel.app/service/assets/fetch(Linux)Binary, chmods it executable on Linux, then spawns it detached and unref'd (stdio: 'ignore', windowsHide: true on Windows) so it runs silently in the background, disconnected from the parent process. The routine is skipped on macOS.

Note on the trigger: the fetch-and-execute routine (_fetch()) is not invoked at the top level of index.js — there is no unconditional call anywhere in the module. It is instead called as the first statement inside the exported pack() function, so the bare node index.js invocation performed by the postinstall hook only defines and exports the functions without itself triggering the download. The dropper fires as a side effect the first time any downstream code calls the package's own pack() API — which is the package's entire ostensible purpose, making activation highly likely for any real consumer while still evading naive "executes immediately on install" detections.

Analysis performed via static review only (npm registry metadata and package source retrieved as text via the npm registry and unpkg CDN) — the package was not installed or executed.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3acd6c2813f34615e913c745f4bfe83a18ca057ec5a109cc30cdd51320eade1a)

package.json declares a postinstall hook that runs index.js. On install, index.js decodes String.fromCharCode arrays to reconstruct the host sloth-antagonist.vercel.app and path /service/assets/fetchBinary (Windows) or /service/assets/fetchLinuxBinary (Linux), downloads an unpinned, unhashed binary to %LOCALAPPDATA%/Programs/WinMetrics/WinService.exe on Windows or ~/.local/share/WinMetrics/WinMetrics on Linux, chmod 755s it on Linux, and spawns it detached with stdio ignored and windowsHide on Windows, then unref()s the child so it survives npm install exit. macOS is skipped. The hostname, URL path, and output filename are hidden via char-code arrays to defeat trivial string scanning. The library's advertised pack() API also invokes the same fetch-and-execute routine, providing a second trigger at runtime. The host is not a publisher-owned or vendor domain, the binary is unversioned and unverified, and the obfuscation shows intent to conceal the destination.