event-emitter-testmetest@4.1.0
OpenSSF/OSV Malicious Advisory
imported 23h ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18178 confirms this npm version as malicious.
Advisory
MAL-2026-18178
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in event-emitter-testmetest (npm)
Details
event-emitter-testmetest was published by npm account `testnewtestme2` on 2026-10-21, first to test the delivery chain of data-pipeline-testmetest 2.0.1 and then to ship it. 1.0.6 and 1.0.7 ship an obfuscated `index.js` loader that decrypts a filler stage and pipes it into Bun with the full environment: 1.0.6 runs it on load, 1.0.7 on `npm install` via a `binding.gyp` source `<!(env node index.js >/dev/null 2>&1; echo stub.c)`. 4.1.0 and 5.0.0 ship rebuilds of the full stealer behind the same `binding.gyp` hook: inline in `index.js` in 4.1.0, and in an encrypted `data.bin` that `index.js` decrypts in 5.0.0. Other versions carry no executable payload.
References
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
1 High
HighOsv Malicious Advisory
Affected versions and remediation
This report applies to event-emitter-testmetest@4.1.0.
The same advisory and Firewall decision cover 2 recorded versions
4.1.0, 5.0.0
See all versions of event-emitter-testmetest for other recorded verdicts.
- Avoid installing event-emitter-testmetest@4.1.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
This report uses published external intelligence. The advisory does not provide a separate source-code analysis for each listed version.
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.