test-dev-config

{"modified":"2026-08-05T17:35:31Z","published":"2026-08-05T17:35:31Z","schema_version":"1.7.4","id":"MAL-2026-13359","summary":"Malicious code in test-dev-config (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (44b80ff2bcf35e5c92c1c8a551b943d334f94793d693ce846707986613db8108)\nsrc/config.js hardcodes a remote host as the English-word phrase \"Four Five P Nine Five P One Eight Six P Two Three Seven\" and decodes it at import time via a textToIp() helper to the IPv4 address 45.95.186.237, then exports SOCKET_SERVER_HOST (port 8008) and DJANGO_API_URL (http://45.95.186.237:8000). The word-to-digit encoding serves solely to hide the destination from string and URL scanners. src/constants.js enumerates Chromium, Chrome, Brave, Edge, Opera, and Vivaldi User Data directories under %LOCALAPPDATA%/%APPDATA%, along with Local Storage, leveldb, Local Extension Settings, and Sync Extension Settings paths, the LastPass Chrome extension ID (hdokiejnpimakedhajhdlcegeplioahd), and a KEYLOGGER_DIR (\"Results\") with a KEYLOGGER_LOG_FILE (\"events.log\"). The package is the shared configuration layer of a browser-credential-stealer and keylogger toolkit: any consumer importing it inherits the C2 endpoint and the browser-secret target-path list.\n","affected":[{"package":{"ecosystem":"npm","name":"test-dev-config"},"versions":["0.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/config.js","sha256":"1e355654c8db0fd5df4b9113585677568b5803765a132e17c7f974f19282f7b1","tlsh":"d231345494b28d700b70affd33bd2992652f275a7e0d849b3139894aaa0e5eb234416f"},{"path":"src/constants.js","sha256":"fd7a99c7b12bb6255e413182e4e469ca30d21e07232e2a9f47156b2bf57becce","tlsh":"c251d06390aa4d3a8679dff83b584141f45f27a5bb4ac8c3747d4a4a242a6f463e043e"}],"package_integrity":[{"filename":"test-dev-config-0.1.0.tgz","hashes":{"sha1":"9ea91cb2b5448859b32822e2da6430351b92be37","sha512_sri":"sha512-5n3RD69tmLMy4VQemYivuyMsvYXWDhrv72IGZR0I1dhQ5nl6TJuod+JSwXOrvw194pxwCUJcZxpDOAzgqJcDVw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/test-dev-config/v/0.1.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015837","import_time":"2026-08-05T18:07:51.088156314Z","modified_time":"2026-08-05T17:35:31Z","sha256":"44b80ff2bcf35e5c92c1c8a551b943d334f94793d693ce846707986613db8108","source":"amazon-inspector","versions":["0.1.0"]}]}}