TESTPACKAGE83 · MAL-2026-19938 · Package
UNINSTALL IT, ROTATE THE KEYS IT COULD READ
Not triaged yet. The sources’ own description is below.
first public Nov 14, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Unknown from the sources.
Unknown from the sources.
-= Per source details. Do not edit below this line.=-
The package's postinstall script downloads an executable from http://185.212.128.180/chromedriver.bat, writes it to ~/.celest/bin/chrome (or chrome.exe), sets it executable, and later launches it through puppeteer-core. The source is a bare IPv4 address over plain HTTP with no hash, signature, or version pinning, and the URL path is a Windows.bat named 'chromedriver' while the package frames the artifact as a patched Chromium. The same download-and-execute path is also reached from src/browser.js, which calls download() followed by puppeteer.launch({ executablePath }) on first library use, so require()/import of the package will fetch and run the binary even when the postinstall step is skipped via CELEST_SKIP_DOWNLOAD. The destination host is not associated with any legitimate Chromium publisher, and the operator of that host fully controls the bytes that are executed on the installer's machine.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.