MAL-2026-18185

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/log-rotate-testmetest/MAL-2026-18185.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18185
Published
2026-10-22T06:11:42Z
Modified
2026-10-22T06:45:04Z
Summary
Malicious code in log-rotate-testmetest (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8608133ab1a2f106c095f84116cd25fa141208dbf81ea6fe2331e38a88551a4b)

The package ships a binding.gyp whose sources field uses GYP command-expansion (<!(env node index.js...)) with no native source files, causing npm's implicit node-gyp rebuild to execute index.js at install time. index.js is a Caesar+10 (ROT) obfuscated eval blob that, once decoded, AES-128-GCM-decrypts a hardcoded hex ciphertext and the sibling data.bin, brotli-decompresses the result, writes it to a mkdtemp'd temporary file, and spawns it under Bun (Bun.spawn([execPath,'run',tmp]) / spawn(getBunPath(),['run',tmp])). package.json declares bun as a runtime dependency, deliberately routing execution through an alternate runtime rather than Node. The executed payload is fully opaque and attacker-controlled. The combination of a no-source binding.gyp used solely as a lifecycle trigger, multi-layer obfuscation (ROT + AES-GCM + brotli), and alternate-runtime dispatch has no legitimate native-build justification.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-021577",
            "import_time":  "2026-10-22T06:30:24.756688262Z",
            "modified_time":  "2026-10-22T06:11:42Z",
            "sha256":  "8608133ab1a2f106c095f84116cd25fa141208dbf81ea6fe2331e38a88551a4b",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / log-rotate-testmetest

Package

Name
log-rotate-testmetest
View open source insights on deps.dev
Purl
pkg:npm/log-rotate-testmetest

Affected ranges

Affected versions

1.*
1.0.1

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "binding.gyp",
            "sha256":  "fda4df745212660faa56de9d1f20739402b418aab082401c38a4d3c1304123d3",
            "tlsh":  "e9c08c2cb838094539d91c3491a88402a4b242a3485a2d41fade60286fb841f288cb9d"
        },
        {
            "path":  "index.js",
            "sha256":  "35050233e0dd6b05184b764aba65de30079053eb081d1fb986207f5683ec3470",
            "tlsh":  "c76264a2678d1ba561880cf6b39d6503a5a0e85f39b07b69ffd24597bd3c522bc20370"
        },
        {
            "path":  "package.json",
            "sha256":  "dec425e6c245b3b552aceb4309ca3273c9f9d450ef0b6d4126355f76359da335",
            "tlsh":  "88d012249822e47315c666661d7a8113f6619d4b0104bc0867c7512847de3b748fe64d"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "log-rotate-testmetest-1.0.1.tgz",
            "hashes":  {
                "sha1":  "80d3bf9ab070888922a2f2bf69fca09f3c2c5acd",
                "sha512_sri":  "sha512-zYo6acnVxU2T0Rl6C3CGkD3pYSpC/MHp+q+F4vZeoxwd3az9k4gQw2pxdCwn+5NNIxVq+5EPydvJBoNt9YN31A=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/log-rotate-testmetest/MAL-2026-18185.json"