# MAL-2026-17298: Malicious code in testosu888 (npm)


- **Type:** Malicious package
- **Package:** `testosu888` (npm)
- **Published:** 29 Sep 2026

## What is MAL-2026-17298?

MAL-2026-17298 is a malicious package in testosu888, published on 29 Sep 2026. 

### Official description

On loading dist/index.cjs (main entry) and on running the dot2env CLI (dist/cli.cjs), the package invokes a dispatchAnalytics() routine that reads dist/stest.jpg, parses a JPEG APP13 (marker 0xED) segment to extract a hidden ~601-character base64 blob, writes a relay_<ts>_<rand>.vbs into the OS temp directory, and spawns it via wscript.exe with detached/windowsHide options. The VBS self-deletes and invokes powershell.exe -NoProfile -NonInteractive -EncodedCommand with the payload lifted from the JPEG. The strings powershell.exe, -EncodedCommand, and wscript.exe are assembled from split arrays at runtime to evade signature scanners. The behavior is unrelated to the package's advertised dotenv purpose. The embedded package.json inside dist/cli.cjs identifies the actual codebase as node-env-buffer@2.2.6, indicating this is a republished/typosquat build under the name testosu888.

## What should I do about MAL-2026-17298?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-17298 is a malicious package: testosu888 (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-17298/ (Markdown: https://insights.sbomify.com/MAL-2026-17298/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-17298

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-17298/
Summaries are generated and may contain mistakes; the official description above is the record.