MAL-2026-18178 Malicious code in event-emitter-testmetest (npm)

event-emitter-testmetest was published by npm account testnewtestme2 on 2026-10-21, first to test the delivery chain of data-pipeline-testmetest 2.0.1 and then to ship it. 1.0.6 and 1.0.7 ship an obfuscated index.js loader that decrypts a filler stage and pipes it into Bun with the full environment: 1.0.6 runs it on load, 1.0.7 on npm install via a binding.gyp source <!(env node index.js >/dev/null 2>&1; echo stub.c). 4.1.0 and 5.0.0 ship rebuilds of the full stealer behind the same binding.gyp hook: inline in index.js in 4.1.0, and in an encrypted data.bin that index.js decrypts in 5.0.0. Other versions carry no executable payload.

The package's main (index.js) is a multi-layer obfuscated loader: a String.fromCharCode-reconstructed string is Caesar-shifted (k=19) and eval'd, which then AES-128-GCM-decrypts a hardcoded hex ciphertext using embedded key/iv/authTag and executes the plaintext via a dynamic Function(module, require, process, Buffer, __filename, __dirname, <plaintext>) call, giving the decrypted bytes full Node module, require, and process access. The payload is opaque to any installer. binding.gyp declares a target with no native source files and uses GYP command-expansion (<!(env node index.js...)) in sources, which runs the loader during node-gyp rebuild — npm invokes node-gyp automatically whenever binding.gyp is present, so the loader runs on npm install even though package.json.scripts contains no install hook. The same loader also executes whenever another module requires this package. The stacked charcode+Caesar+AES-GCM obfuscation and the use of a no-sources binding.gyp purely to trigger node-gyp are consistent only with hiding and auto-executing attacker-controlled code against the installer host.