{"id":"MAL-2026-16317","summary":"Malicious code in testmgkregme (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (496e8021fd5e2626c503e2ceeed8349ff15c68c71a5f19d8a57c67e5f1b41863)\nnpm package testmgkregme@1.0.1 uses a binding.gyp whose `sources` field employs GYP command-expansion (`\u003c!(env node index.js...; echo stub.c)`) to run `node index.js` during `node-gyp rebuild`, which npm invokes automatically when a binding.gyp is present. No native source files (.c/.cc/.cpp/.h) are shipped, so the binding.gyp exists solely to trigger install-time code execution rather than to build a native addon. The executed index.js is a 2.9 MB single-IIFE wrapper: an outer Caesar-cipher (ROT k=4) layer is passed to `eval`, and the decoded body then AES-128-GCM-decrypts hardcoded hex ciphertexts with a hardcoded key/IV/authTag and `eval`s the plaintext. The multi-layer ROT-\u003eeval-\u003eAES-\u003eeval construction has no legitimate purpose and conceals the runtime payload from static review. The result is that `npm install testmgkregme` causes opaque attacker-authored JavaScript to execute on the installer's machine with the installer's privileges.\n","modified":"2026-09-21T03:30:17.630364685Z","published":"2026-09-21T03:23:55Z","database_specific":{"malicious-packages-origins":[{"versions":["1.0.1"],"id":"IN-MAL-2026-020213","import_time":"2026-09-21T03:24:22.111938553Z","modified_time":"2026-09-21T03:23:55Z","sha256":"496e8021fd5e2626c503e2ceeed8349ff15c68c71a5f19d8a57c67e5f1b41863","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/testmgkregme/v/1.0.1"}],"affected":[{"package":{"name":"testmgkregme","ecosystem":"npm","purl":"pkg:npm/testmgkregme"},"versions":["1.0.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/testmgkregme/MAL-2026-16317.json","indicators":{"package_integrity":[{"hashes":{"sha1":"39b5dfc447642ed825c54a6ec16e3afbdd49e52f","sha512_sri":"sha512-xsKzZROzVdKmataoUd9OhroZifu6WGNXG51DDB9m/+r/2hpl3g8dzzYYsmlmhySxXM2E7LQR+ou3ytEZLHV4Pw=="},"filename":"testmgkregme-1.0.1.tgz"}],"evidence_files":[{"path":"binding.gyp","sha256":"1bf3341b5633219a6e25b95cc21b0915eafa9a2d0571b4eaf90f128aac4c8abd","tlsh":"b6c08c2df83c480525dd186441688802a4a040a348462d04b69e20389fa900b689c29e"},{"tlsh":"3dd5ff6bab8a1be4a474ccf3b3497693f0b5c95f3951307966934b73f82ee16c520a10","path":"index.js","sha256":"3fa0c205e38cc21ba2f31decaf40dd570f172ccf0087d2459dc555fdaacb0ff3"}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}