{"id":"MAL-2026-19938","kind":"package","aliases":["MAL-2026-19938"],"related":[],"title":"Malicious code in testpackage83 (npm)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (000cea12be23bd792df9085f773c94b79ee13ae70b5154f7d619847bf1b3f0d7)\nThe package's postinstall script downloads an executable from http://185.212.128.180/chromedriver.bat, writes it to ~/.celest/bin/chrome (or chrome.exe), sets it executable, and later launches it through puppeteer-core. The source is a bare IPv4 address over plain HTTP with no hash, signature, or version pinning, and the URL path is a Windows.bat named 'chromedriver' while the package frames the artifact as a patched Chromium. The same download-and-execute path is also reached from src/browser.js, which calls download() followed by puppeteer.launch({ executablePath }) on first library use, so require()/import of the package will fetch and run the binary even when the postinstall step is skipped via CELEST_SKIP_DOWNLOAD. The destination host is not associated with any legitimate Chromium publisher, and the operator of that host fully controls the bytes that are executed on the installer's machine.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"testpackage83","fixed":[],"affected":"= 1.0.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-14T20:23:49+00:00","first_seen_at":"2026-11-14T21:57:08+00:00","triaged_at":"2026-11-14T21:58:41+00:00","updated_at":"2026-11-14T21:58:41+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-19938':8A,11A '-2026':7A,10A '/.celest/bin/chrome':43C '/chromedriver.bat':39C '/import':118C '000cea12be23bd792df9085f773c94b79ee13ae70b5154f7d619847bf1b3f0d7':28C '185.212.128.180':38C 'address':63C 'also':101C 'amazon':26C 'amazon-inspector':25C 'artifact':88C 'associ':144C 'bare':61C 'binari':127C 'byte':159C 'call':106C 'celest':136C 'chrome.exe':45C 'chromedriv':82C 'chromium':92C,148C 'code':2A 'control':157C 'core':56C 'destin':140C 'detail':17C 'download':34C,96C,107C,138C 'download-and-execut':95C 'edit':20C 'even':128C 'execut':36C,48C,98C,162C 'executablepath':111C 'fetch':123C 'first':113C 'follow':108C 'frame':86C 'fulli':156C 'hash':69C 'host':141C,155C 'http':66C 'inspector':27C 'instal':165C 'ipv4':62C 'later':50C 'launch':51C 'legitim':147C 'librari':114C 'line':23C 'machin':167C 'mal':6A,9A 'malici':1A,13B 'name':81C 'npm':5A 'oper':152C 'packag':14B,30C,85C,121C 'patch':91C 'path':77C,99C 'per':15C 'pin':73C 'plain':65C 'postinstal':32C,131C 'publish':149C 'puppet':55C 'puppeteer-cor':54C 'puppeteer.launch':110C 'reach':102C 'requir':117C 'run':125C 'script':33C 'set':46C 'signatur':70C 'skip':134C,137C 'sourc':16C,24C,58C 'src/browser.js':104C 'step':132C 'testpackage83':4A,12A 'url':76C 'use':115C 'version':72C 'via':135C 'windows.bat':80C 'write':40C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["testpackage83"],"ptokens":["testpackage83"],"labels":["critical","malicious","npm","package"],"campaign_type":null,"search_a":"'-19938':8A,11A '-2026':7A,10A 'code':2A 'mal':6A,9A 'malici':1A 'npm':5A 'testpackage83':4A,12A","search_b":"'malici':13B 'packag':14B","search_c":"'/.celest/bin/chrome':43C '/chromedriver.bat':39C '/import':118C '000cea12be23bd792df9085f773c94b79ee13ae70b5154f7d619847bf1b3f0d7':28C '185.212.128.180':38C 'address':63C 'also':101C 'amazon':26C 'amazon-inspector':25C 'artifact':88C 'associ':144C 'bare':61C 'binari':127C 'byte':159C 'call':106C 'celest':136C 'chrome.exe':45C 'chromedriv':82C 'chromium':92C,148C 'control':157C 'core':56C 'destin':140C 'detail':17C 'download':34C,96C,107C,138C 'download-and-execut':95C 'edit':20C 'even':128C 'execut':36C,48C,98C,162C 'executablepath':111C 'fetch':123C 'first':113C 'follow':108C 'frame':86C 'fulli':156C 'hash':69C 'host':141C,155C 'http':66C 'inspector':27C 'instal':165C 'ipv4':62C 'later':50C 'launch':51C 'legitim':147C 'librari':114C 'line':23C 'machin':167C 'name':81C 'oper':152C 'packag':30C,85C,121C 'patch':91C 'path':77C,99C 'per':15C 'pin':73C 'plain':65C 'postinstal':32C,131C 'publish':149C 'puppet':55C 'puppeteer-cor':54C 'puppeteer.launch':110C 'reach':102C 'requir':117C 'run':125C 'script':33C 'set':46C 'signatur':70C 'skip':134C,137C 'sourc':16C,24C,58C 'src/browser.js':104C 'step':132C 'url':76C 'use':115C 'version':72C 'via':135C 'windows.bat':80C 'write':40C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T20:23:49+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-19938","url":"https://osv.dev/vulnerability/MAL-2026-19938","severity":"critical","published_at":"2026-11-14T20:23:49+00:00","modified_at":"2026-11-14T20:45:04+00:00","first_seen_at":"2026-11-14T21:57:08+00:00","fetched_at":"2026-11-14T21:57:08+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}