MAL-2026-18179

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/log-sink-testmetest/MAL-2026-18179.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18179
Published
2026-10-21T17:30:00Z
Modified
2026-10-22T06:45:04Z
Summary
Malicious code in log-sink-testmetest (npm)
Details

log-sink-testmetest 1.0.1 ships the credential stealer of data-pipeline-testmetest 2.0.1 and runs it on npm install without an install script: its binding.gyp source <!(env node index.js >/dev/null 2>&1; echo stub.c) makes node-gyp run index.js, which decrypts data.bin and pipes it into Bun. The payload is identical to the one in event-emitter-testmetest 5.0.0. Published by npm account testnewtestme2 on 2026-10-21; 1.0.0 is empty.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b429dffb99ce1de5d5c43b4d59da752748d6400d53f36485ce9e78faaa6e6881)

log-sink-testmetest@1.0.1 ships a binding.gyp that uses GYP command expansion <!(env node index.js...; echo stub.c) on a target of type none with no C/C++ sources. Because npm invokes node-gyp rebuild whenever a binding.gyp is present, this expansion causes index.js to be executed on npm install with no scripts declaration. index.js itself is a String.fromCharCode array wrapped in eval() over a Caesar-shifted (shift 10) decryptor stub. The decoded stub reads the sibling data.bin (~372KB opaque blob), AES-128-GCM-decrypts it with hardcoded key/iv/aad, gunzips the result, and then either evals the resulting JavaScript or spawns a Bun runtime and pipes the decrypted payload into Bun via stdin. The binding.gyp ships no native sources, so its sole purpose is to trigger execution of the encrypted payload at install time. The combination of a no-sources binding.gyp used purely as a lifecycle hook, multi-layer obfuscation (charcode → Caesar → eval → AES-GCM → gzip → eval), an opaque encrypted payload, and an alternate-runtime (Bun) execution branch to evade Node-focused inspection is a staged install-time dropper.

Database specific 
{
    "iocs":  {
        "files":  [
            {
                "digests":  {
                    "sha256":  "98caee01817cc52eb5a2ca2307ec039a47ed771d2c34cd7a4b0d174f3423a6fa"
                },
                "note":  "hidden install hook: node-gyp runs `env node index.js`",
                "paths":  [
                    "binding.gyp"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "f0f5586f86e4a432949e595c5c9f15c6588bf8a0f12f924dc3d6ce37e0419165"
                },
                "note":  "obfuscated loader that decrypts `data.bin` and pipes it into `bun run -`",
                "paths":  [
                    "index.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "94f412c3f3e5b6a62be17dd70be471e5df6f2a86ed39cd53587e7c126b454cd8"
                },
                "note":  "AES-GCM-encrypted, gzipped stealer payload",
                "paths":  [
                    "data.bin"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "ca312e76344ef3fd61f6b2c70004f18b2550e8685032a202d895760c87ccbb72"
                },
                "note":  "decrypted 948 KB Bun payload, identical to event-emitter-testmetest 5.0.0",
                "source":  "IN_MEMORY"
            }
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-021573",
            "import_time":  "2026-10-22T06:30:24.356478221Z",
            "modified_time":  "2026-10-22T06:11:12Z",
            "sha256":  "b429dffb99ce1de5d5c43b4d59da752748d6400d53f36485ce9e78faaa6e6881",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / log-sink-testmetest

Package

Name
log-sink-testmetest
View open source insights on deps.dev
Purl
pkg:npm/log-sink-testmetest

Affected ranges

Affected versions

1.*
1.0.1

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "binding.gyp",
            "sha256":  "98caee01817cc52eb5a2ca2307ec039a47ed771d2c34cd7a4b0d174f3423a6fa",
            "tlsh":  "5db09b5d75185e995cd448e0e1d4d94594e61577445a0540c5d6581166643045848b55"
        },
        {
            "path":  "index.js",
            "sha256":  "f0f5586f86e4a432949e595c5c9f15c6588bf8a0f12f924dc3d6ce37e0419165",
            "tlsh":  "3c6262626b891ba561880cf6739d2503a690ec5f39b07b68ffd25557bd3d522bc20370"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "log-sink-testmetest-1.0.1.tgz",
            "hashes":  {
                "sha1":  "0f2e21873d92a8b0dbd8e8486ce5e4c0d6c26567",
                "sha512_sri":  "sha512-XL2pHc22N+kdrpLtKXnaeGMiLeAzHA9AZ490hu91RYqTcugTw//XCxjULzMtUBSVu2RtmVkQRdDglFNoyfuqAQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/log-sink-testmetest/MAL-2026-18179.json"