MAL-2026-11491

Dashboard / Malicious Package / MAL-2026-11491

MAL-2026-11491

Summary: Malicious code in test-dev-host (npm)

Details: Source: amazon-inspector (85b3df759cd11b9c662bed5840b0671d4e9c54a76a606d284ca39390ecf51f8d) [email protected] connects out to a hardcoded socket server (host/port sourced from the test-dev-config module) and enters a receive-loop that dispatches remote messages to handlers for 'command', 'download', 'upload', 'archive', 'install', 'grabext', 'keylog', and 'address'. This gives the remote operator arbitrary shell command execution, file read/write, archive exfiltration, and browser-extension install/theft on the installer's host. On a 'keylog' message the agent flushes a keystroke buffer, computes a hardware fingerprint, and uploads the local keylog file via uploadFileToPublicApi keyed by machineId. src/py_launcher.js also fetches XOR+base64-encrypted (key 'w3x') address replacements from ${DJANGO_API_URL}/address and installs them as helper.wallet_replacements, implementing the clipboard/wallet-address swap pattern that redirects cryptocurrency transfers to attacker-controlled addresses. Obfuscation (base64 + XOR of C2-supplied data) is used to conceal the wallet-swap payload. Source: ghsa-malware (27cded0e4f6f17de980e65abefd0ed8b4a24a7f817e8a8506492d4ed87d5ab82) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References: https://github.com/advisories/GHSA-6v46-5v2x-c3c5, https://www.npmjs.com/package/test-dev-host/v/0.1.0