MAL-2026-18181

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/test-brotli-testmetest/MAL-2026-18181.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18181
Published
2026-10-21T18:00:00Z
Modified
2026-10-22T06:45:05Z
Summary
Malicious code in test-brotli-testmetest (npm)
Details

test-brotli-testmetest 1.0.0 ships a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and runs it on npm install: its install script runs node-gyp rebuild, and the binding.gyp source <!(env node index.js >/dev/null 2>&1; echo stub.c) makes node-gyp run index.js, an obfuscated loader that decrypts a Brotli-compressed payload and pipes it into Bun. Published by npm account testnewtestme2 on 2026-10-21.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d79f43824b57545810f0628c311b37ec5640a6c969053057d0158f46af613b33)

The package ships a binding.gyp whose sources field uses GYP command expansion <!(env node index.js...; echo stub.c) to shell out and run node index.js during node-gyp rebuild. The gyp target type is none and no C/C++ sources are shipped, so the file has no legitimate native-build purpose; its only effect is to invoke index.js at install time. index.js is a ~586KB char-code array decoded via a Caesar-shift substitution and passed to eval. The decoded body uses node:crypto createDecipheriv("aes-128-gcm") with hardcoded hex key/IV/AAD to decrypt a large hex ciphertext, wrapped in a self-executing async IIFE with a swallowed catch. The combination of a build-config command-expansion execution vector, absence of any real native source, and a multi-layer obfuscated/encrypted opaque payload executed at install is the canonical install-time dropper shape — the installer runs attacker-supplied code on npm install with no visibility into what the decrypted payload does.

Database specific 
{
    "iocs":  {
        "files":  [
            {
                "digests":  {
                    "sha256":  "9a876c0a21782b54495d13be1db41e55da1a386c01a3f8dcd15643c609056663"
                },
                "note":  "install hook: node-gyp runs `env node index.js`",
                "paths":  [
                    "binding.gyp"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "13762599a19f5b7133be0b6fda57c20857654c9a42df805eb0325a0c4f2c1a3a"
                },
                "note":  "obfuscated loader; decrypts a Brotli-compressed payload and pipes it into `bun run -`",
                "paths":  [
                    "index.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "d655da796cdc462d6cac0e241310a417e3b7186701cda6e6d822fe50c6f85705"
                },
                "note":  "decrypted 435 KB Bun payload, a rebuild of the data-pipeline-testmetest 2.0.1 stealer",
                "source":  "IN_MEMORY"
            }
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-021571",
            "import_time":  "2026-10-22T06:30:24.123303019Z",
            "modified_time":  "2026-10-22T06:10:57Z",
            "sha256":  "d79f43824b57545810f0628c311b37ec5640a6c969053057d0158f46af613b33",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / test-brotli-testmetest

Package

Name
test-brotli-testmetest
View open source insights on deps.dev
Purl
pkg:npm/test-brotli-testmetest

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "binding.gyp",
            "sha256":  "9a876c0a21782b54495d13be1db41e55da1a386c01a3f8dcd15643c609056663",
            "tlsh":  "d3c08c3cb4380a453ad8082490e8840264b202a3081a2440e6da60286fb841f2449b9e"
        },
        {
            "path":  "index.js",
            "sha256":  "13762599a19f5b7133be0b6fda57c20857654c9a42df805eb0325a0c4f2c1a3a",
            "tlsh":  "32c408d3578c1beda6944cea520c3617a4f2c17b3c6e228dfae24617f43ee217925670"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "test-brotli-testmetest-1.0.0.tgz",
            "hashes":  {
                "sha1":  "e768c2ac5612164acdbae55e1c636b7b9392b5c8",
                "sha512_sri":  "sha512-U/nCnVhBrlknwyvYqoYKKRTP7DWFBmZ8QInGRflLI6gh+vglA7qOo05A5M/g+wvEzIIm6cQjHlNVP/+p/e2/MQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/test-brotli-testmetest/MAL-2026-18181.json"