# MAL-2026-18180: Malicious code in pixel-map-testmetest (npm)


- **Type:** Malicious package
- **Package:** `pixel-map-testmetest` (npm)
- **Published:** 21 Oct 2026

## What is MAL-2026-18180?

MAL-2026-18180 is a malicious package in pixel-map-testmetest, published on 21 Oct 2026. 

### Official description

pixel-map-testmetest 0.0.1 and 0.0.2 ship a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and run it on `npm install`: their `binding.gyp` source `<!(env node index.js >/dev/null 2>&1; echo stub.c)` makes node-gyp run `index.js`, which decrypts `data.bin` and pipes it into Bun. The package.json poses as an npm staged-publishing placeholder (`"stub": true`, "Temporary package placeholder for staged publishing"). Published by npm account `newtestnewdont` on 2026-10-21 after a benign 1.0.0; the same account published benign-looking color-utils-testmetest, string-helpers-testmetest and byte-stride-testmetest. 0.0.2 (published 3.5 hours after 0.0.1) is the same loader and hook with a re-encrypted, additionally obfuscated payload.

On npm install, node-gyp automatically processes binding.gyp. The binding.gyp here declares target type 'none' with no C/C++ sources and abuses GYP command-expansion `<!(env node index.js...; echo stub.c)` to execute index.js at install time. index.js is a Caesar-cipher/charcode-obfuscated loader wrapped in eval that AES-128-GCM-decrypts a 319 KB sibling blob (data.bin) using hex key/iv/aad hardcoded in the loader, brotli-decompresses the result, writes it into a mkdtemp'd `.b-<rand>` directory, and spawns the Bun runtime (declared as an npm dependency `bun ^1.2.18`) to execute the dropped file, bypassing Node-based inspection. package.json sets `stub: true` with description 'Temporary package placeholder for staged publishing' and the README claims a holding version, yet the tarball ships the obfuscated loader, the encrypted blob, the binding.gyp install hook, and the alternate runtime — the stated purpose contradicts the shipped behavior. The actual payload bytes are not inspectable statically; the combination of install-time execution, multi-layer obfuscation, hardcoded-key AES-encrypted blob, drop-to-temp, and alternate-runtime execution matches the npm alternate-runtime dropper pattern.

## What should I do about MAL-2026-18180?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-18180 is a malicious package: pixel-map-testmetest (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-18180/ (Markdown: https://insights.sbomify.com/MAL-2026-18180/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-18180

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-18180/
Summaries are generated and may contain mistakes; the official description above is the record.