{"id":"MAL-2026-18358","revision":null,"records":[{"revision":"bc5baea7def5458ca00a1b499ce2e54e","observedAt":"2026-10-29T15:12:22.973+00:00","statement":{"source":"osv","id":"MAL-2026-18358","aliases":[],"title":"Malicious code in @testsecuiitytestme/cache-helper (npm)","description":"This package installs a credential stealer and self-spreading worm. On a developer machine (it exits under CI, in containers and under a debugger), the install script loads a prebuilt native addon that decodes and runs a hidden, obfuscated Bun program. That program collects npm, GitHub, GitLab, PyPI, RubyGems, JFrog, Docker and cloud (AWS, GCP, Azure) credentials, HashiCorp Vault and Kubernetes secrets, SSH keys, .git-credentials and .env files, browser logins, the macOS keychain, 1Password and Bitwarden, and uses stolen publishing tokens to spread: it publishes to npm, PyPI and RubyGems, injects GitHub workflows and GitLab CI templates, and writes hooks into AI coding assistant configuration. Anyone who installed any version should treat every credential reachable from that machine as exposed: rotate npm, GitHub and cloud tokens, check their own packages for unexpected releases, and check repositories for unexpected workflow changes.\n\n@testsecuiitytestme/cache-helper is the only package of the npm account testsecuiitytestme. It was created on 2026-10-27 at 12:08 UTC with npm's staged-publish placeholder 0.0.0-stage, followed by 1.0.1 (12:28 UTC), 1.0.2 (15:33 UTC) and 1.0.3 (16:24 UTC); a 1.0.0 was removed before 14:21 UTC. It describes itself as \"Cache helper utilities\" and has no README, repository or source code. Four more versions followed on 2026-10-27: 1.0.4 (20:33 UTC), 1.0.5 (21:23 UTC), 1.0.6 (21:45 UTC) and 1.0.7 (22:12 UTC). The whole package was then unpublished at 22:17 UTC (0.0.0-stage and 1.0.1 to 1.0.7).\n\nEach version runs a native addon at install time. 1.0.1 has postinstall: node -e \"try{require(process.platform==='win32'?'./addon_win.node':'./addon.node')}catch(e){}\". 1.0.2 and 1.0.3 depend on node-gyp-build and run it as postinstall, which loads the prebuilt addon shipped in prebuilds/linux-x64/node.napi.node or prebuilds/win32-x64/node.napi.node. 1.0.3 adds a binding.gyp with an empty sources list and an install script node-gyp rebuild, so the package looks like an ordinary native module; there is no C source in any version. 1.0.5 drops node-gyp-build and runs postinstall: node _setup.js, a one-line require of the same prebuilds/<platform>-<arch>/node.napi.node. 1.0.7 runs postinstall: patch-package || node index.js; patch-package is not a dependency, so the command falls through to index.js, which requires the same addon. 1.0.5 and 1.0.7 ship the same .napi_cache as 1.0.3. 1.0.4 and 1.0.6 were not retrieved; each was published with the same install script as the version before it.\n\nThe addon (Linux ELF and Windows PE) is a loader. It checks for CI and sandbox environments (GITHUB_ACTIONS, GITLAB_CI, TRAVIS, CIRCLECI, JENKINS_URL, BUILDKITE, CODEBUILD_BUILD_ID and others, plus SANDBOX), containers (/proc/1/cgroup: docker, containerd, kubepods, podman), a debugger (TracerPid), memory and CPU count, then reads the sibling file .napi_cache, writes it to a hidden temp file and runs it in a detached process.\n\n.napi_cache is JavaScript encoded with a single-byte XOR (0x96). It exits under CI, decodes a second layer (repeating 32-byte XOR, then brotli), locates the Bun runtime or downloads bun 1.2.18 from the official oven-sh/bun GitHub releases, writes the decoded program to the temp directory and runs it detached with Bun. This loader shape matches the second wave of the Shai-Hulud npm worm.\n\nThe Bun program is obfuscated (javascript-obfuscator string table). Its strings show credential collection for npm, GitHub, GitLab, PyPI, RubyGems, JFrog, Docker Hub and GHCR, AWS, GCP, Azure, HashiCorp Vault and Kubernetes, plus .ssh, .git-credentials, .env files, browser login databases, the macOS keychain, 1Password and Bitwarden. They also show propagation: npm publishing with provenance, PyPI and RubyGems publishing, GitHub workflow and composite-action injection, GitLab CI template changes, and writes to AI assistant configuration (.claude/settings.json hooks, .cursor rules, .mcp.json, copilot-instructions.md, CLAUDE.md). The exfiltration endpoints sit behind a further string-encoding layer that was not decoded. Analysis was static only; nothing was executed.\n\nTarball sha256:\n1.0.1: a9c98033ac14fced8376bb8ba32bd92426b3729e16f5cd3852c5a97fc3503002\n1.0.2: 067a1350278fd1ae4fcc261eaca98964dd23a3c7940988ec43f95758480cf113\n1.0.3: 0e99f9a2eb7abcfe65278ca87a8e11dce25f39de2ff4bd77035e2bf01d26f0ed\n1.0.5: 1e00b10ac8e72cc452e44e6af646d15ba8f12692415e7ee3356d7f0b41d39432\n1.0.7: ba6a7f1fc5e2e6704e3af86bc38cdb9cfa4592e88e119f8d906b125abc80fc43\n\nFile sha256:\n1.0.2 prebuilds/linux-x64/node.napi.node: 2547686f86fe6994bcf79558fcce441edc67aa734e255acf79870d5f47de7bbf\n1.0.2 prebuilds/win32-x64/node.napi.node: 620d2489e18b5a5f8840e96b90673d72db4c4c54d555ad66d179b3a5833e7763\n1.0.2 .napi_cache: 463dda65ebceeca6f5590dcdeae6c1d06ffadb2380a85b613deb2923af5557e7\n1.0.3 prebuilds/linux-x64/node.napi.node: 1fdd50b1bf66c4fd0e94f2be3db1f2f0fd77921136867022ad7e65e21220ad03\n1.0.3 prebuilds/win32-x64/node.napi.node: 5b7a0f53f2eca2dd4bf21e6df7d34e751b6cdf70b2f0a6f1f13edfb5caa9570b\n1.0.3 .napi_cache: c14dae9325f451c524cf858ecdae5fa68d2c645ee0981c6f42ef913c7ef34a57\n1.0.5 prebuilds/linux-x64/node.napi.node: 4869759830e75e74e34570be0d67e61fd990432a38352e461164f6671e0eb43f\n1.0.5 prebuilds/win32-x64/node.napi.node: 85ba3587a0cb0a9f61a1142725856f5da909829a67ca888cb69aa3e0627e0b36\n1.0.7 prebuilds/linux-x64/node.napi.node: 7514c7b8a0a6e50a74b01c9b0c0bc8fbeccce4278c8cb64562b35ce310dc9e1f\n1.0.7 prebuilds/win32-x64/node.napi.node: cc0a87e44fbc376f30a8eedfba61b1e7e1d5a5b09831e84af0facaeade19982f\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3ef188a3ae4eae567d3743116d10e586565a2856b53b94add9f84b239aea378e)\nThe package advertises itself as a cache helper but ships no readable JavaScript logic — index.js and _setup.js are one-line stubs that unconditionally load a prebuilt N-API native addon from prebuilds/<platform>-<arch>/node.napi.node, and module.exports is empty. The addon is paired with a 2,397,565-byte sibling file named.napi_cache that contains no printable strings and is identical across linux-x64 and win32-x64 (sha256 c14dae93...4a57). Strings inside the native addon show it reads %s\\.napi_cache, writes a decoded %s.nc%lu.js to the OS temp directory (GetTempPathA), and spawns node on it (CreateProcessA, \"node \\\"%s\\\"\"). This decrypt-drop-and-exec chain runs both from the postinstall hook (node _setup.js) and from the main entrypoint, so every npm install and every require()/import of the package triggers execution of attacker-controlled code whose content cannot be inspected from the shipped source. The native addon additionally performs anti-analysis gating before executing the payload: enumeration of CI environment variables (GITHUB_ACTIONS, GITLAB_CI, TRAVIS, CIRCLECI, JENKINS_URL, BUILDKITE, APPVEYOR, NETLIFY, VERCEL, SANDBOX), checks for analysis tools (wireshark, procmon, procexp, x64dbg, ollydbg, fiddler, httpdebug), Windows debugger checks (IsDebuggerPresent, CheckRemoteDebuggerPresent), and Linux sandbox/container detection (/proc/self/status TracerPid, /proc/1/cgroup, dockerinit). The combination of an empty public API, an opaque 2.4 MB encrypted blob, a native loader that decrypts-writes-execs it to temp, and layered anti-analysis gating has no legitimate caching purpose and matches a classic alternate-execution dropper designed to bypass JavaScript-only scanners.\n","state":0,"publishedAt":"2026-10-29T13:12:02+00:00","modifiedAt":"2026-10-29T14:30:37.019205+00:00","affected":[{"ecosystem":"npm","name":"@testsecuiitytestme/cache-helper","ranges":[],"versions":["1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/@testsecuiitytestme/cache-helper/v/1.0.1","https://www.npmjs.com/package/@testsecuiitytestme/cache-helper/v/1.0.2","https://www.npmjs.com/package/@testsecuiitytestme/cache-helper/v/1.0.3","https://www.npmjs.com/package/@testsecuiitytestme/cache-helper/v/1.0.5","https://www.npmjs.com/package/@testsecuiitytestme/cache-helper/v/1.0.4","https://www.npmjs.com/package/@testsecuiitytestme/cache-helper/v/1.0.7","https://www.npmjs.com/package/@testsecuiitytestme/cache-helper/v/1.0.6"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-18358","license":"OSV · upstream source license applies","key":"osv:MAL-2026-18358","identifiers":["MAL-2026-18358"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T07:27:10.0308911+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T07:27:10.0308911+00:00","lastSuccessAt":"2026-11-07T07:27:10.1806401+00:00","error":null,"lastVerifiedAt":"2026-11-07T07:27:10.180641+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-e2c080f02357fa2a3d144a661c51c212b571c4d7ae811251058237d8f5735e04","complete":true,"records":420765,"lastAttemptAt":"2026-11-07T07:27:09.5001885+00:00","lastSuccessAt":"2026-11-07T07:27:09.4258602+00:00","error":null,"lastVerifiedAt":"2026-11-07T07:27:09.5001885+00:00","snapshotPublishedAt":"2026-11-07T07:18:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-27c3440f97484dda858dd714de0d758d","complete":true,"records":13630,"lastAttemptAt":"2026-11-07T07:38:48.4100635+00:00","lastSuccessAt":"2026-11-07T07:38:48.406+00:00","error":null,"lastVerifiedAt":"2026-11-07T07:38:48.406+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T07:27:10.0308911+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T07:27:10.0308911+00:00","lastSuccessAt":"2026-11-07T07:27:10.181531+00:00","error":null,"lastVerifiedAt":"2026-11-07T07:27:10.1815313+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-1262a9fa83024e28a1560dfc0c9cdf3c","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T07:27:10.8526655+00:00","lastSuccessAt":"2026-11-07T06:27:08.533+00:00","error":null,"lastVerifiedAt":"2026-11-07T06:27:08.533+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T07:27:09.8729489+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T07:27:09.8729489+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T07:27:09.6560768+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T07:27:09.6560768+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T07:27:09.9878127+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T07:27:09.9878127+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-a0b728bc1c5526b5429930c00621636eba8655069c176697c3080f8377619ad7","complete":true,"records":231291,"lastAttemptAt":"2026-11-07T07:27:09.7648455+00:00","lastSuccessAt":"2026-11-07T00:28:51.1983528+00:00","error":null,"lastVerifiedAt":"2026-11-07T07:27:09.7648455+00:00","snapshotPublishedAt":"2026-11-06T23:33:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}