registry / Malware / vybscan-testbed-obfuscated-postinstall

vybscan-testbed-obfuscated-postinstall

This report shows the evidence for vybscan-testbed-obfuscated-postinstall@1.0.0, the only known version.

OpenSSF/OSV Malicious Advisory

imported 4mo ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-10079 confirms this npm version as malicious.

Advisory

MAL-2026-10079

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in vybscan-testbed-obfuscated-postinstall (npm)

Details

package.json declares a postinstall lifecycle script that runs `node -e "eval(Buffer.from('<base64>','base64').toString())"`. Installing the package triggers execution of code that is not visible in the package source and is only materialized at install time by decoding an opaque literal. In this specific version the decoded blob is an inert console.log, but the mechanism — obfuscated-then-eval'd bytes wired into a lifecycle hook — is the canonical install-time remote-code-execution shape and has no legitimate use: it lets whoever controls the package substitute arbitrary code at install without changing readable source. The package's self-description as a testbed fixture does not neutralize the pattern; the same install-time hook would execute whatever bytes were placed in the base64 literal.

References

OpenSSF/OSV advisory PACKAGE

Independent LPM AI assessment

Suspicious

Independent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.

This is a staged/inert payload carrier pattern with real install-time obfuscation but no concrete malicious payload in the inspected source. Downgrade to warning rather than publish block because the dangerous structure is present while confirmed impact is limited to logging.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install lifecycle postinstall

Impact

Runs package-controlled JavaScript at install time; observed payload only prints a message.

Mechanism

base64 decode plus eval in node -e

Attack narrative

When installed, npm runs the package.json postinstall command. That command invokes node -e, decodes a base64 blob, and evals the result. README.md discloses the decoded JavaScript as a console.log message, and package inspection found no network, file mutation, credential harvesting, persistence, shell execution, or AI-agent control-surface modification.

AI rationale

Evidence

package.jsonREADME.md

Independent scan evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for AI warning decision

package.json defines postinstall lifecycle hook: node -e at npm install time
package.json postinstall base64-decodes a string and passes it to eval
README.md and package description discuss scanner/ground-truth expectations, which is reviewer-influencing package text

Evidence against

README.md shows decoded payload is only console.log
rg found no fetch/http execution endpoint, credential access, fs writes, child_process use, persistence, or AI-agent control-surface writes
Only package files present are package.json and README.md

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 0 file(s), 0 B of source

Source & flagged code

2 flagged

package.jsonView file

•scripts.postinstall = node -e "eval(Buffer.from('[redacted]','base64').toString())"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "eval(Buffer.from('[redacted]','base64').toString())"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "eval(Buffer.from('[redacted]','base64').toString())"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "eval(Buffer.from('[redacted]','base64').toString())"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Findings

1 Critical1 High1 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

LowScripts Present

Affected versions and remediation

This report applies to vybscan-testbed-obfuscated-postinstall@1.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing vybscan-testbed-obfuscated-postinstall@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-09 16:50:16.434Z (UTC).

Source advisory published: 2026-07-09 15:45:29.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

1.0.0latestshownMaliciousMalwareBlockPublishedJul 4, 2026, 11:27 AM

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Related packages

Other malware packages

Source & flagged code