testosu8887
A fast, validated, zero-dependency environment configuration toolkit for Node.js
This report shows the evidence for testosu8887@1.0.1, the only known version.
AI Security Review
scanned 23d ago · by lpm-firewall-aiThe package executes an obfuscated bundled Windows payload automatically from both primary entrypoints. This is concrete malware behavior, not a user-requested configuration operation.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Importing dist/index.cjs or starting dist/cli.cjs.
Impact
A package import or CLI invocation can execute an opaque bundled Windows payload.
Mechanism
The code extracts image metadata, creates a temporary VBScript that launches encoded PowerShell, then starts it detached and hidden.
Attack narrative
The package hides a PowerShell launcher inside its compiled entrypoints. On library import or CLI execution, it reads text from a bundled JPEG, constructs a temporary VBScript to run that text as an encoded PowerShell command, and launches it detached with no visible window. This is an active, opaque payload-execution path unrelated to environment configuration.
AI rationale
The package executes an obfuscated bundled Windows payload automatically from both primary entrypoints. This is concrete malware behavior, not a user-requested configuration operation.
Evidence
dist/index.cjsdist/cli.cjsdist/stest.jpg
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The library entrypoint extracts text from the bundled image metadata.
- That text is passed as an encoded PowerShell command through a temporary VBScript launcher.
- The library invokes this launcher immediately when imported.
- The command runs detached with its window hidden.
- The CLI contains the same hidden launcher and invokes it during startup.
Evidence against
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemShell
HighEntropyStringsMinified
Source & flagged code
6 flagged · loading sourcedist/decode.jsView file
1const telemetryFs = require('fs');
L2: const streamPath = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/decode.jsView on unpkg · L1dist/cli.cjs#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/cli.cjs#virtual:normalized:round1View on unpkgdist/cli.cjsView file
•matchType = normalized_sha256
matchedPackage = esm-dotenv@1.0.1
matchedPath = dist/cli.cjs
matchedIdentity = npm:ZXNtLWRvdGVudg:1.0.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
Findings
5 High3 Medium4 Low
HighSemantic Analysis Limiteddist/cli.cjs#virtual:normalized:round1
HighKnown Malware Source Similaritydist/cli.cjs
HighKnown Malware Source Similaritydist/index.cjs
HighAi Review Evidencedist/index.cjs
HighAi Review Evidencedist/index.cjs
MediumDynamic Requiredist/decode.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to testosu8887@1.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing testosu8887@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.