---
id: "MAL-2026-18180"
kind: "package"
aliases: ["MAL-2026-18180"]
title: "Malicious code in pixel-map-testmetest (npm)"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "pixel-map-testmetest", "fixed": [], "affected": "= 0.0.1; = 0.0.2; = 0.0.3", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["malicious", "package"]
not_affected_if: []
published_at: "2026-10-21T18:00:00+00:00"
first_seen_at: "2026-10-26T20:51:49+00:00"
updated_at: "2026-10-26T21:05:48+00:00"
sources: [{"source": "osv-malicious", "url": "https://osv.dev/vulnerability/MAL-2026-18180", "first_seen_at": "2026-10-26T20:51:49+00:00"}]
---

# Malicious code in pixel-map-testmetest (npm)

## Affected

- npm:pixel-map-testmetest affected = 0.0.1; = 0.0.2; = 0.0.3 fixed ?

## Timeline

- 2026-10-26T20:51:49+00:00 osv-malicious https://osv.dev/vulnerability/MAL-2026-18180

## From the sources

pixel-map-testmetest 0.0.1 and 0.0.2 ship a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and run it on `npm install`: their `binding.gyp` source `<!(env node index.js >/dev/null 2>&1; echo stub.c)` makes node-gyp run `index.js`, which decrypts `data.bin` and pipes it into Bun. The package.json poses as an npm staged-publishing placeholder (`"stub": true`, "Temporary package placeholder for staged publishing"). Published by npm account `newtestnewdont` on 2026-10-21 after a benign 1.0.0; the same account published benign-looking color-utils-testmetest, string-helpers-testmetest and byte-stride-testmetest. 0.0.2 (published 3.5 hours after 0.0.1) is the same loader and hook with a re-encrypted, additionally obfuscated payload.

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (65072803ff6a65eee326b518b2039415559b4f8582f44b2f2af2f871aea9f39e)
On npm install, node-gyp automatically processes binding.gyp. The binding.gyp here declares target type 'none' with no C/C++ sources and abuses GYP command-expansion `<!(env node index.js...; echo stub.c)` to execute index.js at install time. index.js is a Caesar-cipher/charcode-obfuscated loader wrapped in eval that AES-128-GCM-decrypts a 319 KB sibling blob (data.bin) using hex key/iv/aad hardcoded in the loader, brotli-decompresses the result, writes it into a mkdtemp'd `.b-<rand>` directory, and spawns the Bun runtime (declared as an npm dependency `bun ^1.2.18`) to execute the dropped file, bypassing Node-based inspection. package.json sets `stub: true` with description 'Temporary package placeholder for staged publishing' and the README claims a holding version, yet the tarball ships the obfuscated loader, the encrypted blob, the binding.gyp install hook, and the alternate runtime — the stated purpose contradicts the shipped behavior. The actual payload bytes are not inspectable statically; the combination of install-time execution, multi-layer obfuscation, hardcoded-key AES-encrypted blob, drop-to-temp, and alternate-runtime execution matches the npm alternate-runtime dropper pattern.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_