MAL-2026-18180 Malicious code in pixel-map-testmetest (npm)

pixel-map-testmetest 0.0.1 and 0.0.2 ship a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and run it on npm install: their binding.gyp source <!(env node index.js >/dev/null 2>&1; echo stub.c) makes node-gyp run index.js, which decrypts data.bin and pipes it into Bun. The package.json poses as an npm staged-publishing placeholder ("stub": true, "Temporary package placeholder for staged publishing"). Published by npm account newtestnewdont on 2026-10-21 after a benign 1.0.0; the same account published benign-looking color-utils-testmetest, string-helpers-testmetest and byte-stride-testmetest. 0.0.2 (published 3.5 hours after 0.0.1) is the same loader and hook with a re-encrypted, additionally obfuscated payload.

On npm install, node-gyp automatically processes binding.gyp. The binding.gyp here declares target type 'none' with no C/C++ sources and abuses GYP command-expansion <!(env node index.js...; echo stub.c) to execute index.js at install time. index.js is a Caesar-cipher/charcode-obfuscated loader wrapped in eval that AES-128-GCM-decrypts a 319 KB sibling blob (data.bin) using hex key/iv/aad hardcoded in the loader, brotli-decompresses the result, writes it into a mkdtemp'd .b-<rand> directory, and spawns the Bun runtime (declared as an npm dependency bun ^1.2.18) to execute the dropped file, bypassing Node-based inspection. package.json sets stub: true with description 'Temporary package placeholder for staged publishing' and the README claims a holding version, yet the tarball ships the obfuscated loader, the encrypted blob, the binding.gyp install hook, and the alternate runtime — the stated purpose contradicts the shipped behavior. The actual payload bytes are not inspectable statically; the combination of install-time execution, multi-layer obfuscation, hardcoded-key AES-encrypted blob, drop-to-temp, and alternate-runtime execution matches the npm alternate-runtime dropper pattern.