Malicious code in event-emitter-testmetest (npm)

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

event-emitter-testmetest was published by npm account `testnewtestme2` on 2026-10-21, first to test the delivery chain of data-pipeline-testmetest 2.0.1 and then to ship it. 1.0.6 and 1.0.7 ship an obfuscated `index.js` loader that decrypts a filler stage and pipes it into Bun with the full environment: 1.0.6 runs it on load, 1.0.7 on `npm install` via a `binding.gyp` source `<!(env node index.js >/dev/null 2>&1; echo stub.c)`. 4.1.0 and 5.0.0 ship rebuilds of the full stealer behind the same `binding.gyp` hook: inline in `index.js` in 4.1.0, and in an encrypted `data.bin` that `index.js` decrypts in 5.0.0. Other versions carry no executable payload. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (8d4e6bad5d24d9c63960e77cc82c054c3b14704bea931cd48c86025fa4dc45c9) The package's `main` (index.js) is a multi-layer obfuscated loader: a String.fromCharCode-reconstructed string is Caesar-shifted (k=19) and eval'd, which then AES-128-GCM-decrypts a hardcoded hex ciphertext using embedded key/iv/authTag and executes the plaintext via a dynamic `Function(module, require, process, Buffer, __filename, __dirname, <plaintext>)` call, giving the decrypted bytes full Node module, require, and process access. The payload is opaque to any installer. `binding.gyp` declares a target with no native source files and uses GYP command-expansion (`<!(env node index.js...)`) in `sources`, which runs the loader during `node-gyp rebuild` — npm invokes node-gyp automatically whenever `binding.gyp` is present, so the loader runs on `npm install` even though `package.json.scripts` contains no install hook. The same loader also executes whenever another module `require`s this package. The stacked charcode+Caesar+AES-GCM obfuscation and the use of a no-sources `binding.gyp` purely to trigger node-gyp are consistent only with hiding and auto-executing attacker-controlled code against the installer host.

Source published

21 Oct 2026 16:00:00 UTC

Source modified

26 Oct 2026 19:00:41 UTC

Observed here

26 Oct 2026 19:35:57 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.