Malicious code in test-brotli-testmetest (npm)

test-brotli-testmetest 1.0.0 ships a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and runs it on npm install: its install script runs node-gyp rebuild, and the binding.gyp source <!(env node index.js >/dev/null 2>&1; echo stub.c) makes node-gyp run index.js, an obfuscated loader that decrypts a Brotli-compressed payload and pipes it into Bun. Published by npm account testnewtestme2 on 2026-10-21.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d79f43824b57545810f0628c311b37ec5640a6c969053057d0158f46af613b33)

The package ships a binding.gyp whose sources field uses GYP command expansion <!(env node index.js...; echo stub.c) to shell out and run node index.js during node-gyp rebuild. The gyp target type is none and no C/C++ sources are shipped, so the file has no legitimate native-build purpose; its only effect is to invoke index.js at install time. index.js is a ~586KB char-code array decoded via a Caesar-shift substitution and passed to eval. The decoded body uses node:crypto createDecipheriv("aes-128-gcm") with hardcoded hex key/IV/AAD to decrypt a large hex ciphertext, wrapped in a self-executing async IIFE with a swallowed catch. The combination of a build-config command-expansion execution vector, absence of any real native source, and a multi-layer obfuscated/encrypted opaque payload executed at install is the canonical install-time dropper shape — the installer runs attacker-supplied code on npm install with no visibility into what the decrypted payload does.