MAL-2026-17298

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/testosu888/MAL-2026-17298.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17298
Published
2026-09-29T23:05:10Z
Modified
2026-09-29T23:30:05Z
Summary
Malicious code in testosu888 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3faa5787fbebe8c5d73f3291c77975efb91c504dddf6a1d82cbe7e9f25372b27)

On loading dist/index.cjs (main entry) and on running the dot2env CLI (dist/cli.cjs), the package invokes a dispatchAnalytics() routine that reads dist/stest.jpg, parses a JPEG APP13 (marker 0xED) segment to extract a hidden ~601-character base64 blob, writes a relay__.vbs into the OS temp directory, and spawns it via wscript.exe with detached/windowsHide options. The VBS self-deletes and invokes powershell.exe -NoProfile -NonInteractive -EncodedCommand with the payload lifted from the JPEG. The strings powershell.exe, -EncodedCommand, and wscript.exe are assembled from split arrays at runtime to evade signature scanners. The behavior is unrelated to the package's advertised dotenv purpose. The embedded package.json inside dist/cli.cjs identifies the actual codebase as node-env-buffer@2.2.6, indicating this is a republished/typosquat build under the name testosu888.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020689",
            "import_time":  "2026-09-29T23:17:35.000688428Z",
            "modified_time":  "2026-09-29T23:05:10Z",
            "sha256":  "3faa5787fbebe8c5d73f3291c77975efb91c504dddf6a1d82cbe7e9f25372b27",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / testosu888

Package

Name
testosu888
View open source insights on deps.dev
Purl
pkg:npm/testosu888

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "dist/index.cjs",
            "sha256":  "97fa0d7666e80c68a3cd4f3326dc31bd9203619d6bbae7449efe62de15c4e815",
            "tlsh":  "4262f784b3dcb03617eb62e190ab4407e9f5da95408c1418f294e4bb35e46db42fbf79"
        },
        {
            "path":  "dist/stest.jpg",
            "sha256":  "7d893367efc0188f70484db358c807b4046fe2a62c23caec88d82e21fa265609",
            "tlsh":  "2154232d75839b34a7acc0e931c27595cf3c29b2f04dc61b4336b6744ea22175ea9da2"
        },
        {
            "path":  "dist/cli.cjs",
            "sha256":  "8556eeca50285aea12dfdcbc4ebcee110d916ef81ddde2e338dcf78bda2028cf",
            "tlsh":  "d792d74473cdb47a17e621d070ab500beaf2cb60459c1504f2dcb07627f4a9a96ebfb9"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "testosu888-1.0.0.tgz",
            "hashes":  {
                "sha1":  "3e703a0860da5a78787929750c51968d4474780d",
                "sha512_sri":  "sha512-YZ7KLOlCBPm4PE6PjA4e+7HVYzWhVvfCrBfinQJLSJ2NovHaCUTXpdrjY/pWzYPjhUJhS7LAgiXTDQ6xfbjhUg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/testosu888/MAL-2026-17298.json"