rust-testing-utils

{"modified":"2026-08-23T03:14:27Z","published":"2026-08-23T03:14:27Z","schema_version":"1.7.4","id":"MAL-2026-14374","summary":"Malicious code in rust-testing-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ee33bdedc7938508bcb50e053c441770948d3d69a51c5cab5d4280d84ceffa65)\nThe package impersonates the pino logger in its README, keywords, and API surface. index.js exports middleware that spawns lib/caller.js as a detached child process on invocation. caller.js reconstructs a hardcoded URL by base64-decoding a value stored under a fake `process.env.DEV_API_KEY` inside a fabricated `process` object, resolving to https://api.jsonstorage.net/v1/json/2ef8c758-a96f-459e-b036-b3b90379a165/f89e8264-86c2-4684-94da-c3f82d59370f. It fetches this URL with axios and passes the returned `cookie` field to `new Function.constructor(\"require\", s)`, then invokes the resulting function with `require` as an argument, giving the remotely fetched code arbitrary execution with full module-loading capability in the consumer's process. The endpoint content is attacker-controlled and mutable, so the executed payload can change at any time without a package update. The base64-encoded URL, fabricated env-var names used to hide the destination, and pino-lookalike cover story are consistent with an intentional supply-chain attack rather than legitimate functionality.\n","affected":[{"package":{"ecosystem":"npm","name":"rust-testing-utils"},"versions":["2.3.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/caller.js","sha256":"ffa61701ff61ebc0c6d64cf09f5bc37a74a91b03b716129b90271d758dc164b7","tlsh":"6e01efd934fd501c021111ea171fa032a010e4373882d6c8374cc7428fa66bd2e93aef"}],"package_integrity":[{"filename":"rust-testing-utils-2.3.0.tgz","hashes":{"sha1":"8b1a3da9fa60a8a338c4e95551620a2591d7d310","sha512_sri":"sha512-L5vNVHqPOd3eApiQG9P/sylHG3hDx2G/Z6KfXbkQvord6iG2HAu9ECtjmUjqi7PJ4SlLs63DZufkTUQ1q8bqZA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/rust-testing-utils/v/2.3.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018568","import_time":"2026-08-23T03:25:56.10785665Z","modified_time":"2026-08-23T03:14:27Z","sha256":"ee33bdedc7938508bcb50e053c441770948d3d69a51c5cab5d4280d84ceffa65","source":"amazon-inspector","versions":["2.3.0"]}]}}