{"id":"MAL-2026-17299","revision":"276d5034526d4e0e9d3bfce3f83afced","records":[{"revision":"276d5034526d4e0e9d3bfce3f83afced","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17299","aliases":[],"title":"Malicious code in testosu8887 (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7d9d3296b770afd3fdebaf4df9d113873e9c77d2d498d2e7941a3465eeb6f97d)\nOn require or CLI invocation, dist/index.cjs and dist/cli.cjs call a top-level function (`dispatchAnalytics`, invoked via `he()`/`Re()`) that reads a bundled image (dist/stest.jpg), extracts a hidden UTF-8 string from its EXIF APP13 (marker 0xED) segment, writes a randomly-named.vbs file to the OS temp directory, and spawns wscript.exe detached with `windowsHide:true` to run it. The VBS launches powershell.exe with an `-EncodedCommand` argument sourced from the image; the decoded PowerShell downloads https://m1.ppy.sh/r/osu!install.exe to %LOCALAPPDATA%\\Temp\\lahost.exe and executes it via Start-Process. Sensitive tokens are assembled at runtime from array joins (`[\"power\",\"shell\",\".exe\"].join(\"\")`, `[\"wscript\",\".exe\"].join(\"\")`, split `-NoProfile`/`-NonInteractive`/`-EncodedCommand` fragments) and the payload body is hidden in JPEG EXIF rather than present as source strings, concealing the behavior from static scanners. The package name suggests a test/typosquat targeting the osu! game community.\n","state":0,"publishedAt":"2026-09-29T23:05:23+00:00","modifiedAt":"2026-09-29T23:30:05.068151+00:00","affected":[{"ecosystem":"npm","name":"testosu8887","ranges":[],"versions":["1.0.1"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/testosu8887/v/1.0.1"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17299","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17299","identifiers":["MAL-2026-17299"]},"retained":false,"historicalAffected":[]}],"coverage":[]}