MAL-2026-18178

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/event-emitter-testmetest/MAL-2026-18178.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18178
Published
2026-10-21T16:00:00Z
Modified
2026-10-22T06:45:04Z
Summary
Malicious code in event-emitter-testmetest (npm)
Details

event-emitter-testmetest was published by npm account testnewtestme2 on 2026-10-21, first to test the delivery chain of data-pipeline-testmetest 2.0.1 and then to ship it. 1.0.6 and 1.0.7 ship an obfuscated index.js loader that decrypts a filler stage and pipes it into Bun with the full environment: 1.0.6 runs it on load, 1.0.7 on npm install via a binding.gyp source <!(env node index.js >/dev/null 2>&1; echo stub.c). 4.1.0 and 5.0.0 ship rebuilds of the full stealer behind the same binding.gyp hook: inline in index.js in 4.1.0, and in an encrypted data.bin that index.js decrypts in 5.0.0. Other versions carry no executable payload.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8d4e6bad5d24d9c63960e77cc82c054c3b14704bea931cd48c86025fa4dc45c9)

The package's main (index.js) is a multi-layer obfuscated loader: a String.fromCharCode-reconstructed string is Caesar-shifted (k=19) and eval'd, which then AES-128-GCM-decrypts a hardcoded hex ciphertext using embedded key/iv/authTag and executes the plaintext via a dynamic Function(module, require, process, Buffer, __filename, __dirname, <plaintext>) call, giving the decrypted bytes full Node module, require, and process access. The payload is opaque to any installer. binding.gyp declares a target with no native source files and uses GYP command-expansion (<!(env node index.js...)) in sources, which runs the loader during node-gyp rebuild — npm invokes node-gyp automatically whenever binding.gyp is present, so the loader runs on npm install even though package.json.scripts contains no install hook. The same loader also executes whenever another module requires this package. The stacked charcode+Caesar+AES-GCM obfuscation and the use of a no-sources binding.gyp purely to trigger node-gyp are consistent only with hiding and auto-executing attacker-controlled code against the installer host.

Database specific 
{
    "iocs":  {
        "files":  [
            {
                "digests":  {
                    "sha256":  "98caee01817cc52eb5a2ca2307ec039a47ed771d2c34cd7a4b0d174f3423a6fa"
                },
                "note":  "1.0.7, 4.1.0 and 5.0.0: hidden install hook, node-gyp runs `env node index.js`",
                "paths":  [
                    "binding.gyp"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "46763d5e3db0c9743a1d140372fd84bfdf870996558d0dd87138a5ec62c8aed3"
                },
                "note":  "1.0.6 and 1.0.7: obfuscated loader that pipes a decrypted stage into `bun run -`",
                "paths":  [
                    "index.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "4de3a8983136dd984ddb7356617902cc28a288f7c8a263ce54bdd925446045f4"
                },
                "note":  "5.0.0: obfuscated loader that decrypts `data.bin` and pipes it into `bun run -`",
                "paths":  [
                    "index.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "e90337816d729e7ef99b1a265add0a1d7bc79c465a98dafd1317fafcec498239"
                },
                "note":  "5.0.0: AES-GCM-encrypted, gzipped stealer payload",
                "paths":  [
                    "data.bin"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "ca312e76344ef3fd61f6b2c70004f18b2550e8685032a202d895760c87ccbb72"
                },
                "note":  "5.0.0: decrypted 948 KB Bun payload, a rebuild of the data-pipeline-testmetest 2.0.1 stealer",
                "source":  "IN_MEMORY"
            },
            {
                "digests":  {
                    "sha256":  "36b2d7337ed694601f9aec854351aaa57da44084a7eac55f7bdbe45e3a07d1ef"
                },
                "note":  "4.1.0: obfuscated loader with the encrypted stealer inline, piped into `bun run -`",
                "paths":  [
                    "index.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "1fc5f1ba027654aae3d5a86e1704a7ae793e4b27da989c4d3e4380e29cb9c15b"
                },
                "note":  "4.1.0: decrypted 941 KB Bun payload, a rebuild of the data-pipeline-testmetest 2.0.1 stealer",
                "source":  "IN_MEMORY"
            }
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-021569",
            "import_time":  "2026-10-22T06:30:23.935568739Z",
            "modified_time":  "2026-10-22T06:10:40Z",
            "sha256":  "9b30c3392dbf88773f8915f1ce7c184fbab6cea4404fdcb90b7ee99282c75875",
            "source":  "amazon-inspector",
            "versions":  [
                "5.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-021567",
            "import_time":  "2026-10-22T06:30:23.673885142Z",
            "modified_time":  "2026-10-22T06:10:26Z",
            "sha256":  "6e34a6ed35dcc77f426c23b9fe66a0ffef71d25de9be144510bc40a9a2f18730",
            "source":  "amazon-inspector",
            "versions":  [
                "4.1.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-021568",
            "import_time":  "2026-10-22T06:30:23.763084189Z",
            "modified_time":  "2026-10-22T06:10:32Z",
            "sha256":  "8d4e6bad5d24d9c63960e77cc82c054c3b14704bea931cd48c86025fa4dc45c9",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.7"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / event-emitter-testmetest

Package

Name
event-emitter-testmetest
View open source insights on deps.dev
Purl
pkg:npm/event-emitter-testmetest

Affected ranges

Affected versions

1.*
1.0.6
1.0.7
4.*
4.1.0
5.*
5.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "binding.gyp",
            "sha256":  "98caee01817cc52eb5a2ca2307ec039a47ed771d2c34cd7a4b0d174f3423a6fa",
            "tlsh":  "5db09b5d75185e995cd448e0e1d4d94594e61577445a0540c5d6581166643045848b55"
        },
        {
            "path":  "index.js",
            "sha256":  "4de3a8983136dd984ddb7356617902cc28a288f7c8a263ce54bdd925446045f4",
            "tlsh":  "e45251536b891be49d74cce6b348b697b0f1c97f394231b8a5924b77fc1de129920a30"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "event-emitter-testmetest-5.0.0.tgz",
            "hashes":  {
                "sha1":  "3d23a5d5f0b6c3c2eb21a30957efd622bd6acc4d",
                "sha512_sri":  "sha512-zDpX7h8EPnU2NwhVIePKnpjFKoS+Nfr26afk3t//MXrmcTq9XG7aDTT3AyM9W9ddDhq+fHrcwbfGAF8JlCiGdA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/event-emitter-testmetest/MAL-2026-18178.json"