---
id: "MAL-2026-18181"
kind: "package"
aliases: ["MAL-2026-18181"]
title: "Malicious code in test-brotli-testmetest (npm)"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "test-brotli-testmetest", "fixed": [], "affected": "= 1.0.0", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["malicious", "package"]
not_affected_if: []
published_at: "2026-10-21T18:00:00+00:00"
first_seen_at: "2026-10-26T20:51:49+00:00"
updated_at: "2026-10-26T21:05:48+00:00"
sources: [{"source": "osv-malicious", "url": "https://osv.dev/vulnerability/MAL-2026-18181", "first_seen_at": "2026-10-26T20:51:49+00:00"}]
---

# Malicious code in test-brotli-testmetest (npm)

## Affected

- npm:test-brotli-testmetest affected = 1.0.0 fixed ?

## Timeline

- 2026-10-26T20:51:49+00:00 osv-malicious https://osv.dev/vulnerability/MAL-2026-18181

## From the sources

test-brotli-testmetest 1.0.0 ships a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and runs it on `npm install`: its `install` script runs `node-gyp rebuild`, and the `binding.gyp` source `<!(env node index.js >/dev/null 2>&1; echo stub.c)` makes node-gyp run `index.js`, an obfuscated loader that decrypts a Brotli-compressed payload and pipes it into Bun. Published by npm account `testnewtestme2` on 2026-10-21.

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (d79f43824b57545810f0628c311b37ec5640a6c969053057d0158f46af613b33)
The package ships a binding.gyp whose sources field uses GYP command expansion `<!(env node index.js...; echo stub.c)` to shell out and run `node index.js` during node-gyp rebuild. The gyp target type is `none` and no C/C++ sources are shipped, so the file has no legitimate native-build purpose; its only effect is to invoke index.js at install time. index.js is a ~586KB char-code array decoded via a Caesar-shift substitution and passed to eval. The decoded body uses node:crypto createDecipheriv("aes-128-gcm") with hardcoded hex key/IV/AAD to decrypt a large hex ciphertext, wrapped in a self-executing async IIFE with a swallowed catch. The combination of a build-config command-expansion execution vector, absence of any real native source, and a multi-layer obfuscated/encrypted opaque payload executed at install is the canonical install-time dropper shape — the installer runs attacker-supplied code on `npm install` with no visibility into what the decrypted payload does.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_