{"id":"MAL-2026-18292","summary":"Malicious code in event-bus-lite-testmetest (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (038b62e6040cef7e651f3cf89c146290f391c28977fe206410408e85ccbe4721)\nThe package ships a binding.gyp whose target has type \"none\" and no C/C++ source files; its only purpose is a GYP `\u003c!(...)` command-expansion that runs `node index.js` during the automatic `node-gyp rebuild` triggered by `npm install`. index.js is multi-layer obfuscated: a char-code array is Caesar-decoded (shift 21) and passed to eval; the decoded body reads the bundled lib_native.dat (~312 KB, high-entropy, sha256 e1ab1e330d3db532d511d4af4386ab2d2c6245ca807410f51c1211ae48814d73), brotli-decompresses and AES-128-GCM-decrypts it with hardcoded key/IV/AAD, writes the plaintext to a `mkdtempSync('.b-')/index.js` temp path, and spawns the Bun runtime (`Bun.spawn`, or `getBunPath()` via child_process.spawn) to execute the decrypted payload. Executing under Bun bypasses Node-only analysis. The contents of the executed payload are not inspectable from the shipped artifact.\n","modified":"2026-10-25T16:30:04.531789852Z","published":"2026-10-25T16:02:07Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["0.0.6"],"id":"IN-MAL-2026-021710","import_time":"2026-10-25T16:17:20.885986401Z","modified_time":"2026-10-25T16:02:07Z","sha256":"038b62e6040cef7e651f3cf89c146290f391c28977fe206410408e85ccbe4721"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/event-bus-lite-testmetest/v/0.0.6"}],"affected":[{"package":{"name":"event-bus-lite-testmetest","ecosystem":"npm","purl":"pkg:npm/event-bus-lite-testmetest"},"versions":["0.0.6"],"database_specific":{"indicators":{"evidence_files":[{"tlsh":"7bc0c059302465739086016cd09fc40c80f3663b00fe1c904c4e9e641f3c2826cca31e","path":"binding.gyp","sha256":"174b6c9e614ba57ddd1e4ef2dd8207629617d4329ed6991e42e393b1f96dfada"},{"sha256":"d0d4ab44881f4392637ca23026579b51e7fc7d01fbae9ead5c74cef96c71e016","tlsh":"4f626062679d2ba271886cf273dd353390e1d91b34612269fae2565bf43da02bcb0770","path":"index.js"},{"sha256":"e1ab1e330d3db532d511d4af4386ab2d2c6245ca807410f51c1211ae48814d73","tlsh":"ac6422b9425c1058942e61e1ce87db25394394cafbdeb1de48c2a58feca05695c3bfe0","path":"lib_native.dat"}],"package_integrity":[{"filename":"event-bus-lite-testmetest-0.0.6.tgz","hashes":{"sha1":"b7c2cf96a04b0d130ab7913ee5fdd9defd1dd125","sha512_sri":"sha512-/LGQZDOaez0X+AEEAI5720Ot1N63YdX2Hw6YojgLSYZorXN7yFki3iB6DF5vG2JU7JZmsipB1FRcpg7g5mYupw=="}}]},"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/event-bus-lite-testmetest/MAL-2026-18292.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}