@testsecuiitytestme/cache-helper@1.0.3
OpenSSF/OSV Malicious Advisory
imported 7d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18358 confirms this npm version as malicious.
Advisory
MAL-2026-18358
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @testsecuiitytestme/cache-helper (npm)
Details
@testsecuiitytestme/cache-helper is the only package of the npm account testsecuiitytestme. It was created on 2026-10-27 at 12:08 UTC with npm's staged-publish placeholder 0.0.0-stage, followed by 1.0.1 (12:28 UTC), 1.0.2 (15:33 UTC) and 1.0.3 (16:24 UTC); a 1.0.0 was removed before 14:21 UTC. It describes itself as "Cache helper utilities" and has no README, repository or source code. 1.0.3 was the latest version and still live at the time of this report.
Each version runs a native addon at install time. 1.0.1 has postinstall: node -e "try{require(process.platform==='win32'?'./addon_win.node':'./addon.node')}catch(e){}". 1.0.2 and 1.0.3 depend on node-gyp-build and run it as postinstall, which loads the prebuilt addon shipped in prebuilds/linux-x64/node.napi.node or prebuilds/win32-x64/node.napi.node. 1.0.3 adds a binding.gyp with an empty sources list and an install script node-gyp rebuild, so the package looks like an ordinary native module; there is no C source in any version.
The addon (Linux ELF and Windows PE) is a loader. It checks for CI and sandbox environments (GITHUB_ACTIONS, GITLAB_CI, TRAVIS, CIRCLECI, JENKINS_URL, BUILDKITE, CODEBUILD_BUILD_ID and others, plus SANDBOX), containers (/proc/1/cgroup: docker, containerd, kubepods, podman), a debugger (TracerPid), memory and CPU count, then reads the sibling file .napi_cache, writes it to a hidden temp file and runs it in a detached process.
.napi_cache is JavaScript encoded with a single-byte XOR (0x96). It exits under CI, decodes a second layer (repeating 32-byte XOR, then brotli), locates the Bun runtime or downloads bun 1.2.18 from the official oven-sh/bun GitHub releases, writes the decoded program to the temp directory and runs it detached with Bun. This loader shape matches the second wave of the Shai-Hulud npm worm.
The Bun program is obfuscated (javascript-obfuscator string table). Its strings show credential collection for npm, GitHub, GitLab, PyPI, RubyGems, JFrog, Docker Hub and GHCR, AWS, GCP, Azure, HashiCorp Vault and Kubernetes, plus .ssh, .git-credentials, .env files, browser login databases, the macOS keychain, 1Password and Bitwarden. They also show propagation: npm publishing with provenance, PyPI and RubyGems publishing, GitHub workflow and composite-action injection, GitLab CI template changes, and writes to AI assistant configuration (.claude/settings.json hooks, .cursor rules, .mcp.json, copilot-instructions.md, CLAUDE.md). The exfiltration endpoints sit behind a further string-encoding layer that was not decoded. Analysis was static only; nothing was executed.
Tarball sha256: 1.0.1: a9c98033ac14fced8376bb8ba32bd92426b3729e16f5cd3852c5a97fc3503002 1.0.2: 067a1350278fd1ae4fcc261eaca98964dd23a3c7940988ec43f95758480cf113 1.0.3: 0e99f9a2eb7abcfe65278ca87a8e11dce25f39de2ff4bd77035e2bf01d26f0ed
File sha256: 1.0.2 prebuilds/linux-x64/node.napi.node: 2547686f86fe6994bcf79558fcce441edc67aa734e255acf79870d5f47de7bbf 1.0.2 prebuilds/win32-x64/node.napi.node: 620d2489e18b5a5f8840e96b90673d72db4c4c54d555ad66d179b3a5833e7763 1.0.2 .napi_cache: 463dda65ebceeca6f5590dcdeae6c1d06ffadb2380a85b613deb2923af5557e7 1.0.3 prebuilds/linux-x64/node.napi.node: 1fdd50b1bf66c4fd0e94f2be3db1f2f0fd77921136867022ad7e65e21220ad03 1.0.3 prebuilds/win32-x64/node.napi.node: 5b7a0f53f2eca2dd4bf21e6df7d34e751b6cdf70b2f0a6f1f13edfb5caa9570b 1.0.3 .napi_cache: c14dae9325f451c524cf858ecdae5fa68d2c645ee0981c6f42ef913c7ef34a57
References
Independent LPM AI assessment
Manual ReviewIndependent AI assessment: manual_review. LPM AI review remains unresolved.
The install hook and runtime entrypoint can load bundled native modules, but inspection did not resolve their behavior: the Windows analysis is partial and the Linux artifact is unsupported. No specific attack was established, so this needs manual review rather than a malicious verdict.
Static reason
No blocking static signals were detected.
Trigger
Package installation or importing its entrypoint.
Impact
The native code runs with the process's permissions; the available analysis does not establish what it does.
Mechanism
The binding helper selects a platform-specific native module and loads it into the process.
AI rationale
The install hook and runtime entrypoint can load bundled native modules, but inspection did not resolve their behavior: the Windows analysis is partial and the Linux artifact is unsupported. No specific attack was established, so this needs manual review rather than a malicious verdict.
Evidence
package.jsonindex.js.lpm-dependency-evidence-9a64c0a2-7fa7-4c29-8605-d3bd0a601a0f/0/npm-linux/node-gyp-build.js.lpm-dependency-evidence-9a64c0a2-7fa7-4c29-8605-d3bd0a601a0f/0/npm-linux/bin.js.lpm-inspection-d7bdtc/0-5b7a0f53f2ec.txt.lpm-inspection-d7bdtc/1-1fdd50b1bf66.txtprebuilds/win32-x64/node.napi.nodeprebuilds/linux-x64/node.napi.node
Independent scan evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The package postinstall runs the native binding helper, which checks for a usable build.
- The package entrypoint also loads the native binding helper when imported.
- The helper loads the selected native module; the Windows artifact analysis leaves call targets uninspected.
- The Linux artifact is executable, but its behavior could not be structurally analyzed.
Evidence against
- The inspected JavaScript selects and loads native builds; it contains no identified network or credential-transfer behavior.
- The package build configuration lists no source files.
Behavioral surface
NativeBindings
Trivial
Source & flagged code
11 flaggedpackage.jsonView file
•scripts registry_only=install
Critical
Manifest Confusion
Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkg•scripts.postinstall = node-gyp-build
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg7"postinstall": "node-gyp-build"
},
"dependencies": {
"node-gyp-build": "^4.8.2"
},
"keywords": [
"cache",
"utils"
],
"license": "MIT"
}
High
Suspicious Lifecycle Evidence
The package postinstall runs the native binding helper, which checks for a usable build.
package.jsonView on unpkg · L7prebuilds/win32-x64/node.napi.node
Findings
1 Critical8 High2 Medium1 Low
CriticalManifest Confusionpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighSuspicious Lifecycle Evidencepackage.json
HighSuspicious Lifecycle Evidence.lpm-dependency-evidence-9a64c0a2-7fa7-4c29-8605-d3bd0a601a0f/0/npm-linux/bin.js
HighAi Review Evidenceindex.js
HighAi Review Evidence.lpm-dependency-evidence-9a64c0a2-7fa7-4c29-8605-d3bd0a601a0f/0/npm-linux/node-gyp-build.js
HighAi Review Evidence.lpm-inspection-d7bdtc/0-5b7a0f53f2ec.txt
HighAi Review Evidence.lpm-inspection-d7bdtc/1-1fdd50b1bf66.txt
HighSuspicious Lifecycle Evidencebinding.gyp
MediumShips Native Binaryprebuilds/win32-x64/node.napi.node
Affected versions and remediation
This report applies to @testsecuiitytestme/cache-helper@1.0.3.
See all versions of @testsecuiitytestme/cache-helper for other recorded verdicts.
- Avoid installing @testsecuiitytestme/cache-helper@1.0.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.