{"id":"MAL-2026-18180","kind":"package","aliases":["MAL-2026-18180"],"related":[],"title":"Malicious code in pixel-map-testmetest (npm)","description":"pixel-map-testmetest 0.0.1 and 0.0.2 ship a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and run it on `npm install`: their `binding.gyp` source `<!(env node index.js >/dev/null 2>&1; echo stub.c)` makes node-gyp run `index.js`, which decrypts `data.bin` and pipes it into Bun. The package.json poses as an npm staged-publishing placeholder (`\"stub\": true`, \"Temporary package placeholder for staged publishing\"). Published by npm account `newtestnewdont` on 2026-10-21 after a benign 1.0.0; the same account published benign-looking color-utils-testmetest, string-helpers-testmetest and byte-stride-testmetest. 0.0.2 (published 3.5 hours after 0.0.1) is the same loader and hook with a re-encrypted, additionally obfuscated payload.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (65072803ff6a65eee326b518b2039415559b4f8582f44b2f2af2f871aea9f39e)\nOn npm install, node-gyp automatically processes binding.gyp. The binding.gyp here declares target type 'none' with no C/C++ sources and abuses GYP command-expansion `<!(env node index.js...; echo stub.c)` to execute index.js at install time. index.js is a Caesar-cipher/charcode-obfuscated loader wrapped in eval that AES-128-GCM-decrypts a 319 KB sibling blob (data.bin) using hex key/iv/aad hardcoded in the loader, brotli-decompresses the result, writes it into a mkdtemp'd `.b-<rand>` directory, and spawns the Bun runtime (declared as an npm dependency `bun ^1.2.18`) to execute the dropped file, bypassing Node-based inspection. package.json sets `stub: true` with description 'Temporary package placeholder for staged publishing' and the README claims a holding version, yet the tarball ships the obfuscated loader, the encrypted blob, the binding.gyp install hook, and the alternate runtime — the stated purpose contradicts the shipped behavior. The actual payload bytes are not inspectable statically; the combination of install-time execution, multi-layer obfuscation, hardcoded-key AES-encrypted blob, drop-to-temp, and alternate-runtime execution matches the npm alternate-runtime dropper pattern.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"pixel-map-testmetest","fixed":[],"affected":"= 0.0.1; = 0.0.2; = 0.0.3","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-21T18:00:00+00:00","first_seen_at":"2026-10-26T20:51:49+00:00","triaged_at":"2026-10-26T20:59:55+00:00","updated_at":"2026-10-26T21:05:48+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-10':96C '-128':206C '-18180':11A,14A '-2026':10A,13A '-21':97C '/charcode-obfuscated':199C '/dev/null':52C '0.0.1':25C,127C '0.0.2':27C,122C '1':54C '1.0.0':101C '1.2.18':247C '2':53C '2.0.1':37C '2026':95C '3.5':124C '319':211C '65072803ff6a65eee326b518b2039415559b4f8582f44b2f2af2f871aea9f39e':155C 'abus':177C 'account':92C,104C 'actual':303C 'addit':139C 'ae':205C,325C 'aes-encrypt':324C 'altern':293C,334C,341C 'alternate-runtim':333C,340C 'amazon':153C 'amazon-inspector':152C 'automat':162C 'b':234C 'base':256C 'behavior':301C 'benign':100C,107C 'benign-look':106C 'binding.gyp':47C,164C,166C,288C 'blob':214C,286C,327C 'brot':224C 'brotli-decompress':223C 'bun':70C,239C,246C 'bypass':253C 'byte':119C,305C 'byte-stride-testmetest':118C 'c/c':174C 'caesar':197C 'caesar-ciph':196C 'cipher':198C 'claim':273C 'code':2A 'color':110C 'color-utils-testmetest':109C 'combin':311C 'command':180C 'command-expans':179C 'contradict':298C 'credenti':38C 'd':233C 'data':34C 'data-pipeline-testmetest':33C 'data.bin':65C,215C 'declar':168C,241C 'decompress':225C 'decrypt':64C,209C 'depend':245C 'descript':263C 'detail':144C 'directori':235C 'drop':251C,329C 'drop-to-temp':328C 'dropper':343C 'echo':55C,185C 'edit':147C 'encrypt':138C,285C,326C 'env':49C,182C 'eval':203C 'execut':188C,249C,316C,336C 'expans':181C 'file':252C 'gcm':208C 'gcm-decrypt':207C 'gyp':60C,161C,178C 'hardcod':219C,322C 'hardcoded-key':321C 'helper':115C 'hex':217C 'hold':275C 'hook':133C,290C 'hour':125C 'index.js':51C,62C,184C,189C,193C 'inspect':257C,308C 'inspector':154C 'instal':45C,158C,191C,289C,314C 'install-tim':313C 'kb':212C 'key':323C 'key/iv/aad':218C 'layer':319C 'line':150C 'loader':131C,200C,222C,283C 'look':108C 'make':57C 'mal':9A,12A 'malici':1A,19B 'map':6A,17A,23C 'match':337C 'mkdtemp':232C 'multi':318C 'multi-lay':317C 'newtestnewdont':93C 'node':50C,59C,160C,183C,255C 'node-bas':254C 'node-gyp':58C,159C 'none':171C 'npm':8A,44C,76C,91C,157C,244C,339C 'obfusc':140C,282C,320C 'packag':20B,84C,265C 'package.json':72C,258C 'pattern':344C 'payload':141C,304C 'per':142C 'pipe':67C 'pipelin':35C 'pixel':5A,16A,22C 'pixel-map-testmetest':4A,15A,21C 'placehold':80C,85C,266C 'pose':73C 'process':163C 'publish':79C,88C,89C,105C,123C,269C 'purpos':297C 're':137C 're-encrypt':136C 'readm':272C 'rebuild':30C 'result':227C 'run':41C,61C 'runtim':240C,294C,335C,342C 'set':259C 'ship':28C,280C,300C 'sibl':213C 'sourc':48C,143C,151C,175C 'spawn':237C 'stage':78C,87C,268C 'staged-publish':77C 'state':296C 'static':309C 'stealer':39C 'stride':120C 'string':114C 'string-helpers-testmetest':113C 'stub':81C,260C 'stub.c':56C,186C 'tarbal':279C 'target':169C 'temp':331C 'temporari':83C,264C 'testmetest':7A,18A,24C,36C,112C,116C,121C 'time':192C,315C 'true':82C,261C 'type':170C 'use':216C 'util':111C 'version':276C 'wrap':201C 'write':228C 'yet':277C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T18:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18180","url":"https://osv.dev/vulnerability/MAL-2026-18180","severity":"critical","published_at":"2026-10-21T18:00:00+00:00","modified_at":"2026-10-22T06:45:05+00:00","first_seen_at":"2026-10-26T20:51:49+00:00","fetched_at":"2026-10-26T20:51:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}