MAL-2026-18177 Malicious code in data-pipeline-testmetest (npm)

data-pipeline-testmetest 2.0.1 is a self-spreading credential stealer that runs on npm install without an install script: its binding.gyp source <!(env node index.js >/dev/null 2>&1; echo stub.c) makes node-gyp run index.js, an obfuscated loader that decrypts a 939 KB payload and pipes it into Bun (downloaded from GitHub if missing). The payload steals GitHub, npm, PyPI, RubyGems and cloud credentials, commits them to a public repository it creates in the victim's GitHub account (description project-utils), and republishes the victim's packages with the same hook. Published by npm account testnewtestme2 on 2026-10-21.

If it finds a GitHub token it installs a net-health-checker user service that runs rm -rf ~/ once the token is revoked. Remove ~/.local/bin/net-health-checker.sh and its systemd unit or LaunchAgent before revoking the token, then rotate all reachable credentials.

The package ships a binding.gyp whose target type is none with no C/C++ sources, and whose sources field uses GYP command expansion <!(env node index.js...; echo stub.c) to invoke the package's own index.js during the implicit node-gyp rebuild that npm runs whenever a binding.gyp is present. This provides install-time code execution without declaring a lifecycle script. index.js is not readable source for the advertised 'test pipeline utilities' purpose: its top-level body is eval(ROT13(charCodeArray)), where the decoded code constructs an AES-128-GCM decipher with hardcoded hex key/IV/authTag and executes the resulting ~1.8MB plaintext. The package also declares bun ^1.2.18 as a runtime dependency, pulling in the Bun runtime installer alongside the obfuscated loader. The combination of a binding.gyp whose only purpose is to run an embedded obfuscated loader, a multi-layer ROT13+AES-GCM-wrapped eval payload with no legible source, and an unrelated alternate-runtime dependency is a loader/dropper structure, not a utility library.