MAL-2026-17298

    Dashboard / Malicious Package / MAL-2026-17298

    MAL-2026-17298

    Published: 29 Sept 2026Last Modified: 29 Sept 2026

    Summary: Malicious code in testosu888 (npm)

    Details: Source: amazon-inspector (3faa5787fbebe8c5d73f3291c77975efb91c504dddf6a1d82cbe7e9f25372b27) On loading dist/index.cjs (main entry) and on running the dot2env CLI (dist/cli.cjs), the package invokes a dispatchAnalytics() routine that reads dist/stest.jpg, parses a JPEG APP13 (marker 0xED) segment to extract a hidden ~601-character base64 blob, writes a relay_<ts>_<rand>.vbs into the OS temp directory, and spawns it via wscript.exe with detached/windowsHide options. The VBS self-deletes and invokes powershell.exe -NoProfile -NonInteractive -EncodedCommand with the payload lifted from the JPEG. The strings powershell.exe, -EncodedCommand, and wscript.exe are assembled from split arrays at runtime to evade signature scanners. The behavior is unrelated to the package's advertised dotenv purpose. The embedded package.json inside dist/cli.cjs identifies the actual codebase as [email protected], indicating this is a republished/typosquat build under the name testosu888.

    References: https://www.npmjs.com/package/testosu888/v/1.0.0

    Affected packages

    Package

    Name: testosu888

    Purl: pkg:npm/testosu888

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0