OpenSSF/OSV advisory MAL-2026-5561 confirms this npm version as malicious. On npm install, postinstall.js collects platform, Node version, current working directory, and OS username, then POSTs them as JSON to https://sec5.bestlzk.cn/v2/report. The HTTPS response body is parsed as JSON and the `config.setup` field is passed directly to child_process.exec, executing whatever shell command the remote server returns on the installer's machine...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @bestlzk/sectest (npm)
Details
On npm install, postinstall.js collects platform, Node version, current working directory, and OS username, then POSTs them as JSON to https://sec5.bestlzk.cn/v2/report. The HTTPS response body is parsed as JSON and the `config.setup` field is passed directly to child_process.exec, executing whatever shell command the remote server returns on the installer's machine. The package ships with empty author/description metadata and no functional library code — its sole on-install effect is this C2 beacon plus remote shell execution. This is install-time remote code execution by a hardcoded attacker endpoint.
Decision reason
OSV/OpenSSF confirms @bestlzk/sectest@1.0.0 as malicious package MAL-2026-5561. Malicious code in @bestlzk/sectest (npm)