{"id":"MAL-2026-19938","summary":"Malicious code in testpackage83 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (000cea12be23bd792df9085f773c94b79ee13ae70b5154f7d619847bf1b3f0d7)\nThe package's postinstall script downloads an executable from http://185.212.128.180/chromedriver.bat, writes it to ~/.celest/bin/chrome (or chrome.exe), sets it executable, and later launches it through puppeteer-core. The source is a bare IPv4 address over plain HTTP with no hash, signature, or version pinning, and the URL path is a Windows.bat named 'chromedriver' while the package frames the artifact as a patched Chromium. The same download-and-execute path is also reached from src/browser.js, which calls download() followed by puppeteer.launch({ executablePath }) on first library use, so require()/import of the package will fetch and run the binary even when the postinstall step is skipped via CELEST_SKIP_DOWNLOAD. The destination host is not associated with any legitimate Chromium publisher, and the operator of that host fully controls the bytes that are executed on the installer's machine.\n","modified":"2026-11-14T20:45:04.623675901Z","published":"2026-11-14T20:23:49Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-022781","import_time":"2026-11-14T20:36:15.249212393Z","modified_time":"2026-11-14T20:23:49Z","sha256":"000cea12be23bd792df9085f773c94b79ee13ae70b5154f7d619847bf1b3f0d7"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/testpackage83/v/1.0.0"}],"affected":[{"package":{"name":"testpackage83","ecosystem":"npm","purl":"pkg:npm/testpackage83"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"sha256":"7b4f423840e854e9c1ee15c81ed327184d0cd3c20e2fdf275fb29744a39f94b4","tlsh":"634261d925fa22359743fa79918f541ab27a9003340e8e48fe9c43147f82178d7e6eed","path":"src/download2.js"},{"path":"src/browser.js","sha256":"b01811754e4f7bf9f008c707017ed9e8328a99a3b4aa8c4196e6ddfc1e8ddc78","tlsh":"5621aaa611fd36905e8318a180ad11733327c94316cdb96274bf1ea06b2e36ca4f9ec9"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-hDZnq7tQMmAKYG18u0qRd8VhIh/S9EX3zGiU17t9q8SIIUle7vooQIRpgu0bBaXyC34ri2ZbV+1E2dpwbl3Veg==","sha1":"297d94a7f9ee6a0d5017b01cb23435f772675b8d"},"filename":"testpackage83-1.0.0.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/testpackage83/MAL-2026-19938.json"}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}