MAL-2026-18292

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/event-bus-lite-testmetest/MAL-2026-18292.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18292
Published
2026-10-25T16:02:07Z
Modified
2026-10-25T16:30:04Z
Summary
Malicious code in event-bus-lite-testmetest (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (038b62e6040cef7e651f3cf89c146290f391c28977fe206410408e85ccbe4721)

The package ships a binding.gyp whose target has type "none" and no C/C++ source files; its only purpose is a GYP <!(...) command-expansion that runs node index.js during the automatic node-gyp rebuild triggered by npm install. index.js is multi-layer obfuscated: a char-code array is Caesar-decoded (shift 21) and passed to eval; the decoded body reads the bundled lib_native.dat (~312 KB, high-entropy, sha256 e1ab1e330d3db532d511d4af4386ab2d2c6245ca807410f51c1211ae48814d73), brotli-decompresses and AES-128-GCM-decrypts it with hardcoded key/IV/AAD, writes the plaintext to a mkdtempSync('.b-')/index.js temp path, and spawns the Bun runtime (Bun.spawn, or getBunPath() via child_process.spawn) to execute the decrypted payload. Executing under Bun bypasses Node-only analysis. The contents of the executed payload are not inspectable from the shipped artifact.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-021710",
            "import_time":  "2026-10-25T16:17:20.885986401Z",
            "modified_time":  "2026-10-25T16:02:07Z",
            "sha256":  "038b62e6040cef7e651f3cf89c146290f391c28977fe206410408e85ccbe4721",
            "source":  "amazon-inspector",
            "versions":  [
                "0.0.6"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / event-bus-lite-testmetest

Package

Name
event-bus-lite-testmetest
View open source insights on deps.dev
Purl
pkg:npm/event-bus-lite-testmetest

Affected ranges

Affected versions

0.*
0.0.6

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "binding.gyp",
            "sha256":  "174b6c9e614ba57ddd1e4ef2dd8207629617d4329ed6991e42e393b1f96dfada",
            "tlsh":  "7bc0c059302465739086016cd09fc40c80f3663b00fe1c904c4e9e641f3c2826cca31e"
        },
        {
            "path":  "index.js",
            "sha256":  "d0d4ab44881f4392637ca23026579b51e7fc7d01fbae9ead5c74cef96c71e016",
            "tlsh":  "4f626062679d2ba271886cf273dd353390e1d91b34612269fae2565bf43da02bcb0770"
        },
        {
            "path":  "lib_native.dat",
            "sha256":  "e1ab1e330d3db532d511d4af4386ab2d2c6245ca807410f51c1211ae48814d73",
            "tlsh":  "ac6422b9425c1058942e61e1ce87db25394394cafbdeb1de48c2a58feca05695c3bfe0"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "event-bus-lite-testmetest-0.0.6.tgz",
            "hashes":  {
                "sha1":  "b7c2cf96a04b0d130ab7913ee5fdd9defd1dd125",
                "sha512_sri":  "sha512-/LGQZDOaez0X+AEEAI5720Ot1N63YdX2Hw6YojgLSYZorXN7yFki3iB6DF5vG2JU7JZmsipB1FRcpg7g5mYupw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/event-bus-lite-testmetest/MAL-2026-18292.json"