MAL-2026-15562

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/test-in-one/MAL-2026-15562.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-15562

Published

2026-08-29T02:09:01Z

Modified

2026-08-29T02:30:12.980220378Z

Summary

Malicious code in test-in-one (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4834c80d92d51ee12f73395ddc87c681baf4f911c6bbec54a9110cc55a9c4ae9)

The package declares a local file: dependency (detector at file:.yalc/detector) whose postinstall script (src/scripts/check.js) executes automatically on npm install. The script walks the installer's home directory, Desktop, Documents, Projects, and cwd to harvest desktop crypto-wallet directories, browser extension LevelDB stores (MetaMask, Phantom, and similar), ~/.ssh/* private keys, ~/.aws/credentials, ~/.git-credentials, .env*, .npmrc/.yarnrc, and the full process.env. The collected files are tarred and POSTed to a hardcoded Telegram Bot API endpoint (https://api.telegram.org/bot<redacted>/sendDocument, chat_id 416517694). The script additionally contains npm worm scaffolding: after collecting an npm token it calls whoami against registry.npmjs.org, enumerates all packages owned by the maintainer via the registry search API, and for each package downloads the tarball, injects a postinstall hook, bumps the version, writes a .npmrc with the stolen token, and prepares publication (the final publish call is currently gated by if (false), but token theft, maintainer enumeration, and the injector pipeline are live). Bundling the payload as a file: dependency causes npm to install and run its lifecycle hooks without a registry fetch, making the manifest itself the delivery vector.

Database specific

{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019128",
            "modified_time": "2026-08-29T02:09:01Z",
            "import_time": "2026-08-29T02:22:19.802528476Z",
            "source": "amazon-inspector",
            "sha256": "4834c80d92d51ee12f73395ddc87c681baf4f911c6bbec54a9110cc55a9c4ae9",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}

References

https://www.npmjs.com/package/test-in-one/v/1.0.0

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / test-in-one

Package

Name: test-in-one; View open source insights on deps.dev
Purl: pkg:npm/test-in-one

Affected ranges

Affected versions

1.*

1.0.0

Database specific

cwes

[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]

indicators

{
    "package_integrity": [
        {
            "filename": "test-in-one-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-ddH/kSaSoHCItU2dehnmOJAiw3/M2VyYcv8/Cy5CkCgdiu0uDZJVUs+riJrbWqnZEE0O0SJe76uspq/Kah1TRg==",
                "sha1": "229b17a4168dbe4fb1188d317b8a64a4bab00541"
            }
        }
    ],
    "evidence_files": [
        {
            "path": ".yalc/detector/src/scripts/check.js",
            "tlsh": "28c2ea3645ff50504273f1ea9b1b60097618a4333218da887b5cc79c6fc67a882f3aad",
            "sha256": "74987bee7b6b9aff9dad9fe8ae929ba2b75c00243ae51791f3674049e739b2c8"
        },
        {
            "path": ".yalc/detector/src/npmInjector/inject.js",
            "tlsh": "3771631369e3d07056376688d52bc0152e2e3907b208f898f78f8ba7cf6326592179bc",
            "sha256": "a266da243d9c833b529155b92656a43a7c50a8c5aecfc88280e09dca68ea5fdf"
        },
        {
            "path": "package.json",
            "tlsh": "02e086308d646b7369ca11d54c774103a9711f5b0004ae1db2c3551d975d5b744bd36f",
            "sha256": "eaea47c0bd1eb3fc1863016d3e436074de6ab7a9c42adb4f712fb567a7f8cc72"
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/test-in-one/MAL-2026-15562.json"