registry / Remote code execution / testosu888
testosu888
A fast, validated, zero-dependency environment configuration toolkit for Node.js
This report shows the evidence for testosu888@1.0.0, the only known version.
AI Security Review
scanned 23d ago · by lpm-firewall-aiAutomatic execution of a hidden encoded PowerShell payload from a JPEG is concrete malicious behavior. Block publication.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Importing or requiring the CommonJS entry point, or running the CLI.
Impact
This enables arbitrary code execution under the package consumer's account on Windows.
Mechanism
Code extracts JPEG metadata, writes a temporary VBScript, and starts detached wscript.exe to run an encoded PowerShell command.
Attack narrative
Both executable entry points automatically extract concealed content from a JPEG and launch it through a detached, hidden Windows script host. The script starts PowerShell with an encoded command, so the payload can execute without being visible in the JavaScript source. This is active remote-code-execution behavior, not a dormant asset.
AI rationale
Automatic execution of a hidden encoded PowerShell payload from a JPEG is concrete malicious behavior. Block publication.
Evidence
dist/index.cjsdist/cli.cjsdist/stest.jpg
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- Package metadata exposes the affected CommonJS entry point and command-line executable.
- The CommonJS library reads text concealed in stest.jpg.
- It constructs a hidden script that starts an encoded PowerShell command.
- The library invokes this launcher immediately during module loading.
- The command-line executable contains and immediately invokes the same launcher.
- The JPEG contains a concealed printable encoded payload.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell
HighEntropyStringsMinified
Source & flagged code
6 flagged · loading sourcedist/decode.jsView file
1const telemetryFs = require('fs');
L2: const streamPath = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/decode.jsView on unpkg · L1dist/cli.cjs#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/cli.cjs#virtual:normalized:round1View on unpkgdist/cli.cjsView file
•matchType = normalized_sha256
matchedPackage = esm-dotenv@1.0.1
matchedPath = dist/cli.cjs
matchedIdentity = npm:ZXNtLWRvdGVudg:1.0.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
Findings
5 High3 Medium4 Low
HighSemantic Analysis Limiteddist/cli.cjs#virtual:normalized:round1
HighKnown Malware Source Similaritydist/cli.cjs
HighKnown Malware Source Similaritydist/index.cjs
HighKnown Malware Source Fingerprint Signaturedist/cli.cjs
HighAi Review Evidencepackage.json
MediumDynamic Requiredist/decode.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to testosu888@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing testosu888@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.