---
id: "MAL-2026-18177"
kind: "package"
aliases: ["MAL-2026-18177"]
title: "Malicious code in data-pipeline-testmetest (npm)"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "data-pipeline-testmetest", "fixed": [], "affected": "= 2.0.1", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["malicious", "package"]
not_affected_if: []
published_at: "2026-10-21T16:00:00+00:00"
first_seen_at: "2026-10-26T20:51:49+00:00"
updated_at: "2026-10-26T21:05:48+00:00"
sources: [{"source": "osv-malicious", "url": "https://osv.dev/vulnerability/MAL-2026-18177", "first_seen_at": "2026-10-26T20:51:49+00:00"}]
---

# Malicious code in data-pipeline-testmetest (npm)

## Affected

- npm:data-pipeline-testmetest affected = 2.0.1 fixed ?

## Timeline

- 2026-10-26T20:51:49+00:00 osv-malicious https://osv.dev/vulnerability/MAL-2026-18177

## From the sources

data-pipeline-testmetest 2.0.1 is a self-spreading credential stealer that runs on `npm install` without an install script: its `binding.gyp` source `<!(env node index.js >/dev/null 2>&1; echo stub.c)` makes node-gyp run `index.js`, an obfuscated loader that decrypts a 939 KB payload and pipes it into Bun (downloaded from GitHub if missing). The payload steals GitHub, npm, PyPI, RubyGems and cloud credentials, commits them to a public repository it creates in the victim's GitHub account (description `project-utils`), and republishes the victim's packages with the same hook. Published by npm account `testnewtestme2` on 2026-10-21.

If it finds a GitHub token it installs a `net-health-checker` user service that runs `rm -rf ~/` once the token is revoked. Remove `~/.local/bin/net-health-checker.sh` and its systemd unit or LaunchAgent before revoking the token, then rotate all reachable credentials.

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (8975c3fc55ad84db15b5c688966a64a3befb41447d1c6c1ad0acf50df93fe409)
The package ships a binding.gyp whose target type is `none` with no C/C++ sources, and whose `sources` field uses GYP command expansion `<!(env node index.js...; echo stub.c)` to invoke the package's own index.js during the implicit `node-gyp rebuild` that npm runs whenever a binding.gyp is present. This provides install-time code execution without declaring a lifecycle script. index.js is not readable source for the advertised 'test pipeline utilities' purpose: its top-level body is `eval(ROT13(charCodeArray))`, where the decoded code constructs an AES-128-GCM decipher with hardcoded hex key/IV/authTag and executes the resulting ~1.8MB plaintext. The package also declares `bun ^1.2.18` as a runtime dependency, pulling in the Bun runtime installer alongside the obfuscated loader. The combination of a binding.gyp whose only purpose is to run an embedded obfuscated loader, a multi-layer ROT13+AES-GCM-wrapped eval payload with no legible source, and an unrelated alternate-runtime dependency is a loader/dropper structure, not a utility library.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_