{"id":"MAL-2026-18185","summary":"Malicious code in log-rotate-testmetest (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8608133ab1a2f106c095f84116cd25fa141208dbf81ea6fe2331e38a88551a4b)\nThe package ships a binding.gyp whose `sources` field uses GYP command-expansion (`\u003c!(env node index.js...)`) with no native source files, causing npm's implicit `node-gyp rebuild` to execute index.js at install time. index.js is a Caesar+10 (ROT) obfuscated eval blob that, once decoded, AES-128-GCM-decrypts a hardcoded hex ciphertext and the sibling `data.bin`, brotli-decompresses the result, writes it to a mkdtemp'd temporary file, and spawns it under Bun (`Bun.spawn([execPath,'run',tmp])` / `spawn(getBunPath(),['run',tmp])`). package.json declares `bun` as a runtime dependency, deliberately routing execution through an alternate runtime rather than Node. The executed payload is fully opaque and attacker-controlled. The combination of a no-source binding.gyp used solely as a lifecycle trigger, multi-layer obfuscation (ROT + AES-GCM + brotli), and alternate-runtime dispatch has no legitimate native-build justification.\n","modified":"2026-10-22T06:45:04.771060861Z","published":"2026-10-22T06:11:42Z","database_specific":{"malicious-packages-origins":[{"sha256":"8608133ab1a2f106c095f84116cd25fa141208dbf81ea6fe2331e38a88551a4b","source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-021577","import_time":"2026-10-22T06:30:24.756688262Z","modified_time":"2026-10-22T06:11:42Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/log-rotate-testmetest/v/1.0.1"}],"affected":[{"package":{"name":"log-rotate-testmetest","ecosystem":"npm","purl":"pkg:npm/log-rotate-testmetest"},"versions":["1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"hashes":{"sha1":"80d3bf9ab070888922a2f2bf69fca09f3c2c5acd","sha512_sri":"sha512-zYo6acnVxU2T0Rl6C3CGkD3pYSpC/MHp+q+F4vZeoxwd3az9k4gQw2pxdCwn+5NNIxVq+5EPydvJBoNt9YN31A=="},"filename":"log-rotate-testmetest-1.0.1.tgz"}],"evidence_files":[{"path":"binding.gyp","sha256":"fda4df745212660faa56de9d1f20739402b418aab082401c38a4d3c1304123d3","tlsh":"e9c08c2cb838094539d91c3491a88402a4b242a3485a2d41fade60286fb841f288cb9d"},{"path":"index.js","sha256":"35050233e0dd6b05184b764aba65de30079053eb081d1fb986207f5683ec3470","tlsh":"c76264a2678d1ba561880cf6b39d6503a5a0e85f39b07b69ffd24597bd3c522bc20370"},{"path":"package.json","sha256":"dec425e6c245b3b552aceb4309ca3273c9f9d450ef0b6d4126355f76359da335","tlsh":"88d012249822e47315c666661d7a8113f6619d4b0104bc0867c7512847de3b748fe64d"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/log-rotate-testmetest/MAL-2026-18185.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}