---
id: "GHSA-pv54-r48f-chvp"
page: "https://infrastack.ai/live/GHSA-pv54-r48f-chvp"
kind: "package"
aliases: ["GHSA-pv54-r48f-chvp", "MAL-2026-10438"]
title: "Malicious code in netspeedutil (npm)"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "netspeedutil", "note": "all versions", "fixed": [], "affected": "", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["malicious", "package"]
not_affected_if: []
published_at: "2026-07-13T09:22:42+00:00"
first_seen_at: "2026-11-11T17:28:37+00:00"
updated_at: "2026-11-11T17:30:36+00:00"
sources: [{"source": "osv-malicious", "url": "https://osv.dev/vulnerability/MAL-2026-10438", "first_seen_at": "2026-11-11T17:28:37+00:00"}]
exploit_sources: []
---

# Malicious code in netspeedutil (npm)

Link for people: https://infrastack.ai/live/GHSA-pv54-r48f-chvp (this .md is for agents)

## Affected

- npm:netspeedutil affected range not listed fixed no fixed version listed

## Timeline

- 2026-11-11T17:28:37+00:00 osv-malicious https://osv.dev/vulnerability/MAL-2026-10438

## From the sources

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (e07c032df7e95243bcbf1af8d20d23ef9427620fc3050965ca1a3b3ce9faa4f1)
On install, setup.js walks up to the installer's project tree and scans image files for a '__STEG__' marker. When found, it AES-256-CBC-decrypts an embedded steganographic payload that points to a file inside the installer's node_modules and uses a regex (`cli.command("build [root]"...finally{...}`) to patch that third-party CLI's build command, prepending an import of netspeedutil/inject.js and an `await inject()` call inside the build's finally block. Once tampered, every subsequent project build runs inject.js, which uses javascript-obfuscator (control-flow flattening, dead-code injection, base64 string-array encoding) to embed an obfuscated client into dist/index.html. That client opens a WebRTC TURN connection to a hardcoded attacker host at 13.234.111.178:3478 as a covert C2 / signaling channel and renders attacker-supplied DOM content to end users of any site the developer ships. The package's stated purpose ('Fast string matching and pattern validation utilities') is a cover story unrelated to the actual code. This is a build-pipeline supply-chain compromise: the installer's production artifacts are silently weaponized against their own end users.

## Source: ghsa-malware (2389b90e574f057509766a600f3be29adddcf1b4185c6696122fdb3bf285428b)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_