{"answers":{"affected":"1 open source package ship an affected version, including log-sink-testmetest.","exploited":"There is no known exploitation of MAL-2026-18179 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-18179 is a malicious package in log-sink-testmetest, published on 21 Oct 2026."},"fix_prompt":"MAL-2026-18179 is a malicious package: log-sink-testmetest (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-18179/ (Markdown: https://insights.sbomify.com/MAL-2026-18179/index.md)","id":"MAL-2026-18179","markdown":"https://insights.sbomify.com/MAL-2026-18179/index.md","name":"MAL-2026-18179","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"log-sink-testmetest 1.0.1 ships the credential stealer of data-pipeline-testmetest 2.0.1 and runs it on `npm install` without an install script: its `binding.gyp` source `\u003c!(env node index.js \u003e/dev/null 2\u003e\u00261; echo stub.c)` makes node-gyp run `index.js`, which decrypts `data.bin` and pipes it into Bun. The payload is identical to the one in event-emitter-testmetest 5.0.0. Published by npm account `testnewtestme2` on 2026-10-21; 1.0.0 is empty.\n\nlog-sink-testmetest@1.0.1 ships a binding.gyp that uses GYP command expansion `\u003c!(env node index.js...; echo stub.c)` on a target of type `none` with no C/C++ sources. Because npm invokes `node-gyp rebuild` whenever a binding.gyp is present, this expansion causes index.js to be executed on `npm install` with no `scripts` declaration. index.js itself is a String.fromCharCode array wrapped in eval() over a Caesar-shifted (shift 10) decryptor stub. The decoded stub reads the sibling data.bin (~372KB opaque blob), AES-128-GCM-decrypts it with hardcoded key/iv/aad, gunzips the result, and then either `eval`s the resulting JavaScript or spawns a Bun runtime and pipes the decrypted payload into Bun via stdin. The binding.gyp ships no native sources, so its sole purpose is to trigger execution of the encrypted payload at install time. The combination of a no-sources binding.gyp used purely as a lifecycle hook, multi-layer obfuscation (charcode → Caesar → eval → AES-GCM → gzip → eval), an opaque encrypted payload, and an alternate-runtime (Bun) execution branch to evade Node-focused inspection is a staged install-time dropper.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in log-sink-testmetest (npm)","id":"MAL-2026-18179","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"log-sink-testmetest","purl":"pkg:npm/log-sink-testmetest","source":"MAL-2026-18179"}],"products":null,"published":"2026-10-21","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-18179/"}