Malicious code in testosu8887 (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (7d9d3296b770afd3fdebaf4df9d113873e9c77d2d498d2e7941a3465eeb6f97d) On require or CLI invocation, dist/index.cjs and dist/cli.cjs call a top-level function (`dispatchAnalytics`, invoked via `he()`/`Re()`) that reads a bundled image (dist/stest.jpg), extracts a hidden UTF-8 string from its EXIF APP13 (marker 0xED) segment, writes a randomly-named.vbs file to the OS temp directory, and spawns wscript.exe detached with `windowsHide:true` to run it. The VBS launches powershell.exe with an `-EncodedCommand` argument sourced from the image; the decoded PowerShell downloads https://m1.ppy.sh/r/osu!install.exe to %LOCALAPPDATA%\Temp\lahost.exe and executes it via Start-Process. Sensitive tokens are assembled at runtime from array joins (`["power","shell",".exe"].join("")`, `["wscript",".exe"].join("")`, split `-NoProfile`/`-NonInteractive`/`-EncodedCommand` fragments) and the payload body is hidden in JPEG EXIF rather than present as source strings, concealing the behavior from static scanners. The package name suggests a test/typosquat targeting the osu! game community.
MAL-2026-17299
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17299
testosu8887
Source reference: /affected/0/package/name
- Affected versions
- 1.0.1
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "testosu8887",
"purl": "pkg:npm/testosu8887",
"ecosystem": "npm"
},
"versions": [
"1.0.1"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/testosu8887/MAL-2026-17299.json",
"indicators": {
"evidence_files": [
{
"path": "dist/index.cjs",
"tlsh": "4262f784b3dcb03617eb62e190ab4407e9f5da95408c1418f294e4bb35e46db42fbf79",
"sha256": "97fa0d7666e80c68a3cd4f3326dc31bd9203619d6bbae7449efe62de15c4e815"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "5bfcaae8723847baf2898c1b3e1d924ab68edf7c",
"sha512_sri": "sha512-2uLHmNF2WteyqIp5aRnh/WhfpRd14pGvf+yIgFMd2w7M8y00wZ+EwS9F2T4oegBRZs6TSf/oE8O9FIZtz0ornQ=="
},
"filename": "testosu8887-1.0.1.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #32237 · Revision 1
- Added to Heist Feed
- Publisher date