MAL-2026-17298 Malicious code in testosu888 (npm)
Malicious package
Published
MAL-2026-17298 is a malicious package: testosu888 (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-17298/ (Markdown: https://insights.sbomify.com/MAL-2026-17298/index.md)
- Package
- testosu888
- Registry
- npm
What is MAL-2026-17298?
MAL-2026-17298 is a malicious package in testosu888, published on 29 Sep 2026.
Official description
On loading dist/index.cjs (main entry) and on running the dot2env CLI (dist/cli.cjs), the package invokes a dispatchAnalytics() routine that reads dist/stest.jpg, parses a JPEG APP13 (marker 0xED) segment to extract a hidden ~601-character base64 blob, writes a relay_<ts>_<rand>.vbs into the OS temp directory, and spawns it via wscript.exe with detached/windowsHide options. The VBS self-deletes and invokes powershell.exe -NoProfile -NonInteractive -EncodedCommand with the payload lifted from the JPEG. The strings powershell.exe, -EncodedCommand, and wscript.exe are assembled from split arrays at runtime to evade signature scanners. The behavior is unrelated to the package's advertised dotenv purpose. The embedded package.json inside dist/cli.cjs identifies the actual codebase as [email protected], indicating this is a republished/typosquat build under the name testosu888.
What should I do about MAL-2026-17298?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.