# MAL-2026-18177: Malicious code in data-pipeline-testmetest (npm)


- **Type:** Malicious package
- **Package:** `data-pipeline-testmetest` (npm)
- **Published:** 21 Oct 2026

## What is MAL-2026-18177?

MAL-2026-18177 is a malicious package in data-pipeline-testmetest, published on 21 Oct 2026. 

### Official description

data-pipeline-testmetest 2.0.1 is a self-spreading credential stealer that runs on `npm install` without an install script: its `binding.gyp` source `<!(env node index.js >/dev/null 2>&1; echo stub.c)` makes node-gyp run `index.js`, an obfuscated loader that decrypts a 939 KB payload and pipes it into Bun (downloaded from GitHub if missing). The payload steals GitHub, npm, PyPI, RubyGems and cloud credentials, commits them to a public repository it creates in the victim's GitHub account (description `project-utils`), and republishes the victim's packages with the same hook. Published by npm account `testnewtestme2` on 2026-10-21.

If it finds a GitHub token it installs a `net-health-checker` user service that runs `rm -rf ~/` once the token is revoked. Remove `~/.local/bin/net-health-checker.sh` and its systemd unit or LaunchAgent before revoking the token, then rotate all reachable credentials.

The package ships a binding.gyp whose target type is `none` with no C/C++ sources, and whose `sources` field uses GYP command expansion `<!(env node index.js...; echo stub.c)` to invoke the package's own index.js during the implicit `node-gyp rebuild` that npm runs whenever a binding.gyp is present. This provides install-time code execution without declaring a lifecycle script. index.js is not readable source for the advertised 'test pipeline utilities' purpose: its top-level body is `eval(ROT13(charCodeArray))`, where the decoded code constructs an AES-128-GCM decipher with hardcoded hex key/IV/authTag and executes the resulting ~1.8MB plaintext. The package also declares `bun ^1.2.18` as a runtime dependency, pulling in the Bun runtime installer alongside the obfuscated loader. The combination of a binding.gyp whose only purpose is to run an embedded obfuscated loader, a multi-layer ROT13+AES-GCM-wrapped eval payload with no legible source, and an unrelated alternate-runtime dependency is a loader/dropper structure, not a utility library.

## What should I do about MAL-2026-18177?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-18177 is a malicious package: data-pipeline-testmetest (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-18177/ (Markdown: https://insights.sbomify.com/MAL-2026-18177/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-18177

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-18177/
Summaries are generated and may contain mistakes; the official description above is the record.