MAL-2026-19938

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/testpackage83/MAL-2026-19938.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-19938
Published
2026-11-14T20:23:49Z
Modified
2026-11-14T20:45:04Z
Summary
Malicious code in testpackage83 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (000cea12be23bd792df9085f773c94b79ee13ae70b5154f7d619847bf1b3f0d7)

The package's postinstall script downloads an executable from http://185.212.128.180/chromedriver.bat, writes it to ~/.celest/bin/chrome (or chrome.exe), sets it executable, and later launches it through puppeteer-core. The source is a bare IPv4 address over plain HTTP with no hash, signature, or version pinning, and the URL path is a Windows.bat named 'chromedriver' while the package frames the artifact as a patched Chromium. The same download-and-execute path is also reached from src/browser.js, which calls download() followed by puppeteer.launch({ executablePath }) on first library use, so require()/import of the package will fetch and run the binary even when the postinstall step is skipped via CELEST_SKIP_DOWNLOAD. The destination host is not associated with any legitimate Chromium publisher, and the operator of that host fully controls the bytes that are executed on the installer's machine.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-022781",
            "import_time": "2026-11-14T20:36:15.249212393Z",
            "modified_time": "2026-11-14T20:23:49Z",
            "sha256": "000cea12be23bd792df9085f773c94b79ee13ae70b5154f7d619847bf1b3f0d7",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / testpackage83

Package

Name
testpackage83
View open source insights on deps.dev
Purl
pkg:npm/testpackage83

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "src/download2.js",
            "sha256": "7b4f423840e854e9c1ee15c81ed327184d0cd3c20e2fdf275fb29744a39f94b4",
            "tlsh": "634261d925fa22359743fa79918f541ab27a9003340e8e48fe9c43147f82178d7e6eed"
        },
        {
            "path": "src/browser.js",
            "sha256": "b01811754e4f7bf9f008c707017ed9e8328a99a3b4aa8c4196e6ddfc1e8ddc78",
            "tlsh": "5621aaa611fd36905e8318a180ad11733327c94316cdb96274bf1ea06b2e36ca4f9ec9"
        }
    ],
    "package_integrity": [
        {
            "filename": "testpackage83-1.0.0.tgz",
            "hashes": {
                "sha1": "297d94a7f9ee6a0d5017b01cb23435f772675b8d",
                "sha512_sri": "sha512-hDZnq7tQMmAKYG18u0qRd8VhIh/S9EX3zGiU17t9q8SIIUle7vooQIRpgu0bBaXyC34ri2ZbV+1E2dpwbl3Veg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/testpackage83/MAL-2026-19938.json"