{"answers":{"affected":"1 open source package ship an affected version, including event-emitter-testmetest.","exploited":"There is no known exploitation of MAL-2026-18178 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-18178 is a malicious package in event-emitter-testmetest, published on 21 Oct 2026."},"fix_prompt":"MAL-2026-18178 is a malicious package: event-emitter-testmetest (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-18178/ (Markdown: https://insights.sbomify.com/MAL-2026-18178/index.md)","id":"MAL-2026-18178","markdown":"https://insights.sbomify.com/MAL-2026-18178/index.md","name":"MAL-2026-18178","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"event-emitter-testmetest was published by npm account `testnewtestme2` on 2026-10-21, first to test the delivery chain of data-pipeline-testmetest 2.0.1 and then to ship it. 1.0.6 and 1.0.7 ship an obfuscated `index.js` loader that decrypts a filler stage and pipes it into Bun with the full environment: 1.0.6 runs it on load, 1.0.7 on `npm install` via a `binding.gyp` source `\u003c!(env node index.js \u003e/dev/null 2\u003e\u00261; echo stub.c)`. 4.1.0 and 5.0.0 ship rebuilds of the full stealer behind the same `binding.gyp` hook: inline in `index.js` in 4.1.0, and in an encrypted `data.bin` that `index.js` decrypts in 5.0.0. Other versions carry no executable payload.\n\nThe package's `main` (index.js) is a multi-layer obfuscated loader: a String.fromCharCode-reconstructed string is Caesar-shifted (k=19) and eval'd, which then AES-128-GCM-decrypts a hardcoded hex ciphertext using embedded key/iv/authTag and executes the plaintext via a dynamic `Function(module, require, process, Buffer, __filename, __dirname, \u003cplaintext\u003e)` call, giving the decrypted bytes full Node module, require, and process access. The payload is opaque to any installer. `binding.gyp` declares a target with no native source files and uses GYP command-expansion (`\u003c!(env node index.js...)`) in `sources`, which runs the loader during `node-gyp rebuild` — npm invokes node-gyp automatically whenever `binding.gyp` is present, so the loader runs on `npm install` even though `package.json.scripts` contains no install hook. The same loader also executes whenever another module `require`s this package. The stacked charcode+Caesar+AES-GCM obfuscation and the use of a no-sources `binding.gyp` purely to trigger node-gyp are consistent only with hiding and auto-executing attacker-controlled code against the installer host.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in event-emitter-testmetest (npm)","id":"MAL-2026-18178","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"event-emitter-testmetest","purl":"pkg:npm/event-emitter-testmetest","source":"MAL-2026-18178"}],"products":null,"published":"2026-10-21","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-18178/"}