MAL-2026-17299

    Dashboard / Malicious Package / MAL-2026-17299

    MAL-2026-17299

    Published: 29 Sept 2026Last Modified: 29 Sept 2026

    Summary: Malicious code in testosu8887 (npm)

    Details: Source: amazon-inspector (7d9d3296b770afd3fdebaf4df9d113873e9c77d2d498d2e7941a3465eeb6f97d) On require or CLI invocation, dist/index.cjs and dist/cli.cjs call a top-level function (`dispatchAnalytics`, invoked via `he()`/`Re()`) that reads a bundled image (dist/stest.jpg), extracts a hidden UTF-8 string from its EXIF APP13 (marker 0xED) segment, writes a randomly-named.vbs file to the OS temp directory, and spawns wscript.exe detached with `windowsHide:true` to run it. The VBS launches powershell.exe with an `-EncodedCommand` argument sourced from the image; the decoded PowerShell downloads https://m1.ppy.sh/r/osu!install.exe to %LOCALAPPDATA%\Temp\lahost.exe and executes it via Start-Process. Sensitive tokens are assembled at runtime from array joins (`["power","shell",".exe"].join("")`, `["wscript",".exe"].join("")`, split `-NoProfile`/`-NonInteractive`/`-EncodedCommand` fragments) and the payload body is hidden in JPEG EXIF rather than present as source strings, concealing the behavior from static scanners. The package name suggests a test/typosquat targeting the osu! game community.

    References: https://www.npmjs.com/package/testosu8887/v/1.0.1

    Affected packages

    Package

    Name: testosu8887

    Purl: pkg:npm/testosu8887

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.1