{"id":"MAL-2026-18292","kind":"package","aliases":["MAL-2026-18292"],"related":[],"title":"Malicious code in event-bus-lite-testmetest (npm)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (038b62e6040cef7e651f3cf89c146290f391c28977fe206410408e85ccbe4721)\nThe package ships a binding.gyp whose target has type \"none\" and no C/C++ source files; its only purpose is a GYP `<!(...)` command-expansion that runs `node index.js` during the automatic `node-gyp rebuild` triggered by `npm install`. index.js is multi-layer obfuscated: a char-code array is Caesar-decoded (shift 21) and passed to eval; the decoded body reads the bundled lib_native.dat (~312 KB, high-entropy, sha256 e1ab1e330d3db532d511d4af4386ab2d2c6245ca807410f51c1211ae48814d73), brotli-decompresses and AES-128-GCM-decrypts it with hardcoded key/IV/AAD, writes the plaintext to a `mkdtempSync('.b-')/index.js` temp path, and spawns the Bun runtime (`Bun.spawn`, or `getBunPath()` via child_process.spawn) to execute the decrypted payload. Executing under Bun bypasses Node-only analysis. The contents of the executed payload are not inspectable from the shipped artifact.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"event-bus-lite-testmetest","fixed":[],"affected":"= 0.0.6","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-25T16:02:07+00:00","first_seen_at":"2026-10-26T20:51:52+00:00","triaged_at":"2026-10-26T20:53:36+00:00","updated_at":"2026-10-26T21:05:48+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-128':116C '-18292':12A,15A '-2026':11A,14A '/index.js':131C '038b62e6040cef7e651f3cf89c146290f391c28977fe206410408e85ccbe4721':36C '21':92C '312':104C 'ae':115C 'amazon':34C 'amazon-inspector':33C 'analysi':156C 'array':86C 'artifact':169C 'automat':67C 'b':130C 'binding.gyp':41C 'bodi':99C 'brot':112C 'brotli-decompress':111C 'bun':137C,151C 'bun.spawn':139C 'bundl':102C 'bus':6A,18A 'bypass':152C 'c/c':49C 'caesar':89C 'caesar-decod':88C 'char':84C 'char-cod':83C 'child_process.spawn':143C 'code':2A,85C 'command':59C 'command-expans':58C 'content':158C 'decod':90C,98C 'decompress':113C 'decrypt':119C,147C 'detail':25C 'e1ab1e330d3db532d511d4af4386ab2d2c6245ca807410f51c1211ae48814d73':110C 'edit':28C 'entropi':108C 'eval':96C 'event':5A,17A 'event-bus-lite-testmetest':4A,16A 'execut':145C,149C,161C 'expans':60C 'file':51C 'gcm':118C 'gcm-decrypt':117C 'getbunpath':141C 'gyp':57C,70C 'hardcod':122C 'high':107C 'high-entropi':106C 'index.js':64C,76C 'inspect':165C 'inspector':35C 'instal':75C 'kb':105C 'key/iv/aad':123C 'layer':80C 'lib_native.dat':103C 'line':31C 'lite':7A,19A 'mal':10A,13A 'malici':1A,21B 'mkdtempsync':129C 'multi':79C 'multi-lay':78C 'node':63C,69C,154C 'node-gyp':68C 'node-on':153C 'none':46C 'npm':9A,74C 'obfusc':81C 'packag':22B,38C 'pass':94C 'path':133C 'payload':148C,162C 'per':23C 'plaintext':126C 'purpos':54C 'read':100C 'rebuild':71C 'run':62C 'runtim':138C 'sha256':109C 'shift':91C 'ship':39C,168C 'sourc':24C,32C,50C 'spawn':135C 'target':43C 'temp':132C 'testmetest':8A,20A 'trigger':72C 'type':45C 'via':142C 'whose':42C 'write':124C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T16:02:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18292","url":"https://osv.dev/vulnerability/MAL-2026-18292","severity":"critical","published_at":"2026-10-25T16:02:07+00:00","modified_at":"2026-10-25T16:30:04+00:00","first_seen_at":"2026-10-26T20:51:52+00:00","fetched_at":"2026-10-26T20:51:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}