registry / testosu8887 / 1.0.1

testosu8887@1.0.1

A fast, validated, zero-dependency environment configuration toolkit for Node.js

AI Security Review

scanned 9d ago · by lpm-firewall-ai

Both the importable library and CLI conceal a Windows command launcher in bundled code. They load command material from a packaged image and execute it without user action beyond import or CLI use.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Importing dist/index.cjs or starting dist/cli.cjs.

Impact

A package import or CLI invocation can execute an opaque bundled Windows payload.

Mechanism

The code extracts image metadata, creates a temporary VBScript that launches encoded PowerShell, then starts it detached and hidden.

Attack narrative

The package hides a PowerShell launcher inside its compiled entrypoints. On library import or CLI execution, it reads text from a bundled JPEG, constructs a temporary VBScript to run that text as an encoded PowerShell command, and launches it detached with no visible window. This is an active, opaque payload-execution path unrelated to environment configuration.

AI rationale

The package executes an obfuscated bundled Windows payload automatically from both primary entrypoints. This is concrete malware behavior, not a user-requested configuration operation.

Evidence

dist/index.cjsdist/cli.cjsdist/stest.jpg

OSV advisory

OpenSSF/OSV

Advisory

MAL-2026-17299

Source

OpenSSF Malicious Packages via OSV

On require or CLI invocation, dist/index.cjs and dist/cli.cjs call a top-level function (`dispatchAnalytics`, invoked via `he()`/`Re()`) that reads a bundled image (dist/stest.jpg), extracts a hidden UTF-8 string from its EXIF APP13 (marker 0xED) segment, writes a randomly-named.vbs file to the OS temp directory, and spawns wscript.exe detached with `windowsHide:true` to run it. The VBS launches powershell.exe with an `-EncodedCommand` argument sourced from the image; the decoded PowerShell downloads https://m1.ppy.sh/r/osu!install.exe to %LOCALAPPDATA%\Temp\lahost.exe and executes it via Start-Process. Sensitive tokens are assembled at runtime from array joins (`["power","shell",".exe"].join("")`, `["wscript",".exe"].join("")`, split `-NoProfile`/`-NonInteractive`/`-EncodedCommand` fragments) and the payload body is hidden in JPEG EXIF rather than present as source strings, concealing the behavior from static scanners. The package name suggests a test/typosquat targeting the osu! game community.

testosu8887@1.0.1

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code