{"id":"MAL-2026-18185","kind":"package","aliases":["MAL-2026-18185"],"related":[],"title":"Malicious code in log-rotate-testmetest (npm)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8608133ab1a2f106c095f84116cd25fa141208dbf81ea6fe2331e38a88551a4b)\nThe package ships a binding.gyp whose `sources` field uses GYP command-expansion (`<!(env node index.js...)`) with no native source files, causing npm's implicit `node-gyp rebuild` to execute index.js at install time. index.js is a Caesar+10 (ROT) obfuscated eval blob that, once decoded, AES-128-GCM-decrypts a hardcoded hex ciphertext and the sibling `data.bin`, brotli-decompresses the result, writes it to a mkdtemp'd temporary file, and spawns it under Bun (`Bun.spawn([execPath,'run',tmp])` / `spawn(getBunPath(),['run',tmp])`). package.json declares `bun` as a runtime dependency, deliberately routing execution through an alternate runtime rather than Node. The executed payload is fully opaque and attacker-controlled. The combination of a no-source binding.gyp used solely as a lifecycle trigger, multi-layer obfuscation (ROT + AES-GCM + brotli), and alternate-runtime dispatch has no legitimate native-build justification.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"log-rotate-testmetest","fixed":[],"affected":"= 1.0.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-22T06:11:42+00:00","first_seen_at":"2026-10-26T20:51:49+00:00","triaged_at":"2026-10-26T20:57:54+00:00","updated_at":"2026-10-26T21:05:48+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'+10':74C '-128':83C '-18185':11A,14A '-2026':10A,13A '8608133ab1a2f106c095f84116cd25fa141208dbf81ea6fe2331e38a88551a4b':34C 'ae':82C,168C 'aes-gcm':167C 'altern':133C,173C 'alternate-runtim':172C 'amazon':32C 'amazon-inspector':31C 'attack':146C 'attacker-control':145C 'binding.gyp':39C,155C 'blob':78C 'brot':96C,170C 'brotli-decompress':95C 'build':181C 'bun':112C,123C 'bun.spawn':113C 'caesar':73C 'caus':56C 'ciphertext':90C 'code':2A 'combin':149C 'command':46C 'command-expans':45C 'control':147C 'd':105C 'data.bin':94C 'declar':122C 'decod':81C 'decompress':97C 'decrypt':86C 'deliber':128C 'depend':127C 'detail':23C 'dispatch':175C 'edit':26C 'env':48C 'eval':77C 'execpath':114C 'execut':65C,130C,139C 'expans':47C 'field':42C 'file':55C,107C 'fulli':142C 'gcm':85C,169C 'gcm-decrypt':84C 'getbunpath':118C 'gyp':44C,62C 'hardcod':88C 'hex':89C 'implicit':59C 'index.js':50C,66C,70C 'inspector':33C 'instal':68C 'justif':182C 'layer':164C 'legitim':178C 'lifecycl':160C 'line':29C 'log':5A,16A 'log-rotate-testmetest':4A,15A 'mal':9A,12A 'malici':1A,19B 'mkdtemp':104C 'multi':163C 'multi-lay':162C 'nativ':53C,180C 'native-build':179C 'no-sourc':152C 'node':49C,61C,137C 'node-gyp':60C 'npm':8A,57C 'obfusc':76C,165C 'opaqu':143C 'packag':20B,36C 'package.json':121C 'payload':140C 'per':21C 'rather':135C 'rebuild':63C 'result':99C 'rot':75C,166C 'rotat':6A 'rotate':17A 'rout':129C 'run':115C,119C 'runtim':126C,134C,174C 'ship':37C 'sibl':93C 'sole':157C 'sourc':22C,30C,41C,54C,154C 'spawn':109C,117C 'temporari':106C 'testmetest':7A,18A 'time':69C 'tmp':116C,120C 'trigger':161C 'use':43C,156C 'whose':40C 'write':100C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T06:11:42+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18185","url":"https://osv.dev/vulnerability/MAL-2026-18185","severity":"critical","published_at":"2026-10-22T06:11:42+00:00","modified_at":"2026-10-22T06:45:04+00:00","first_seen_at":"2026-10-26T20:51:49+00:00","fetched_at":"2026-10-26T20:51:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}