---
id: "MAL-2026-18178"
kind: "package"
aliases: ["MAL-2026-18178"]
title: "Malicious code in event-emitter-testmetest (npm)"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "event-emitter-testmetest", "fixed": [], "affected": "= 1.0.6; = 1.0.7; = 4.1.0; = 5.0.0", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["malicious", "package"]
not_affected_if: []
published_at: "2026-10-21T16:00:00+00:00"
first_seen_at: "2026-10-26T20:51:55+00:00"
updated_at: "2026-10-26T21:05:48+00:00"
sources: [{"source": "osv-malicious", "url": "https://osv.dev/vulnerability/MAL-2026-18178", "first_seen_at": "2026-10-26T20:51:55+00:00"}]
---

# Malicious code in event-emitter-testmetest (npm)

## Affected

- npm:event-emitter-testmetest affected = 1.0.6; = 1.0.7; = 4.1.0; = 5.0.0 fixed ?

## Timeline

- 2026-10-26T20:51:55+00:00 osv-malicious https://osv.dev/vulnerability/MAL-2026-18178

## From the sources

event-emitter-testmetest was published by npm account `testnewtestme2` on 2026-10-21, first to test the delivery chain of data-pipeline-testmetest 2.0.1 and then to ship it. 1.0.6 and 1.0.7 ship an obfuscated `index.js` loader that decrypts a filler stage and pipes it into Bun with the full environment: 1.0.6 runs it on load, 1.0.7 on `npm install` via a `binding.gyp` source `<!(env node index.js >/dev/null 2>&1; echo stub.c)`. 4.1.0 and 5.0.0 ship rebuilds of the full stealer behind the same `binding.gyp` hook: inline in `index.js` in 4.1.0, and in an encrypted `data.bin` that `index.js` decrypts in 5.0.0. Other versions carry no executable payload.

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (8d4e6bad5d24d9c63960e77cc82c054c3b14704bea931cd48c86025fa4dc45c9)
The package's `main` (index.js) is a multi-layer obfuscated loader: a String.fromCharCode-reconstructed string is Caesar-shifted (k=19) and eval'd, which then AES-128-GCM-decrypts a hardcoded hex ciphertext using embedded key/iv/authTag and executes the plaintext via a dynamic `Function(module, require, process, Buffer, __filename, __dirname, <plaintext>)` call, giving the decrypted bytes full Node module, require, and process access. The payload is opaque to any installer. `binding.gyp` declares a target with no native source files and uses GYP command-expansion (`<!(env node index.js...)`) in `sources`, which runs the loader during `node-gyp rebuild` — npm invokes node-gyp automatically whenever `binding.gyp` is present, so the loader runs on `npm install` even though `package.json.scripts` contains no install hook. The same loader also executes whenever another module `require`s this package. The stacked charcode+Caesar+AES-GCM obfuscation and the use of a no-sources `binding.gyp` purely to trigger node-gyp are consistent only with hiding and auto-executing attacker-controlled code against the installer host.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_