Malicious code in testosu888 (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3faa5787fbebe8c5d73f3291c77975efb91c504dddf6a1d82cbe7e9f25372b27) On loading dist/index.cjs (main entry) and on running the dot2env CLI (dist/cli.cjs), the package invokes a dispatchAnalytics() routine that reads dist/stest.jpg, parses a JPEG APP13 (marker 0xED) segment to extract a hidden ~601-character base64 blob, writes a relay__.vbs into the OS temp directory, and spawns it via wscript.exe with detached/windowsHide options. The VBS self-deletes and invokes powershell.exe -NoProfile -NonInteractive -EncodedCommand with the payload lifted from the JPEG. The strings powershell.exe, -EncodedCommand, and wscript.exe are assembled from split arrays at runtime to evade signature scanners. The behavior is unrelated to the package's advertised dotenv purpose. The embedded package.json inside dist/cli.cjs identifies the actual codebase as node-env-buffer@2.2.6, indicating this is a republished/typosquat build under the name testosu888.
MAL-2026-17298
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17298
testosu888
Source reference: /affected/0/package/name
- Affected versions
- 1.0.0
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "testosu888",
"purl": "pkg:npm/testosu888",
"ecosystem": "npm"
},
"versions": [
"1.0.0"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/testosu888/MAL-2026-17298.json",
"indicators": {
"evidence_files": [
{
"path": "dist/index.cjs",
"tlsh": "4262f784b3dcb03617eb62e190ab4407e9f5da95408c1418f294e4bb35e46db42fbf79",
"sha256": "97fa0d7666e80c68a3cd4f3326dc31bd9203619d6bbae7449efe62de15c4e815"
},
{
"path": "dist/stest.jpg",
"tlsh": "2154232d75839b34a7acc0e931c27595cf3c29b2f04dc61b4336b6744ea22175ea9da2",
"sha256": "7d893367efc0188f70484db358c807b4046fe2a62c23caec88d82e21fa265609"
},
{
"path": "dist/cli.cjs",
"tlsh": "d792d74473cdb47a17e621d070ab500beaf2cb60459c1504f2dcb07627f4a9a96ebfb9",
"sha256": "8556eeca50285aea12dfdcbc4ebcee110d916ef81ddde2e338dcf78bda2028cf"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "3e703a0860da5a78787929750c51968d4474780d",
"sha512_sri": "sha512-YZ7KLOlCBPm4PE6PjA4e+7HVYzWhVvfCrBfinQJLSJ2NovHaCUTXpdrjY/pWzYPjhUJhS7LAgiXTDQ6xfbjhUg=="
},
"filename": "testosu888-1.0.0.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #32233 · Revision 1
- Added to Heist Feed
- Publisher date