testosu888

{"modified":"2026-09-29T23:05:10Z","published":"2026-09-29T23:05:10Z","schema_version":"1.7.4","id":"MAL-2026-17298","summary":"Malicious code in testosu888 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3faa5787fbebe8c5d73f3291c77975efb91c504dddf6a1d82cbe7e9f25372b27)\nOn loading dist/index.cjs (main entry) and on running the dot2env CLI (dist/cli.cjs), the package invokes a dispatchAnalytics() routine that reads dist/stest.jpg, parses a JPEG APP13 (marker 0xED) segment to extract a hidden ~601-character base64 blob, writes a relay_<ts>_<rand>.vbs into the OS temp directory, and spawns it via wscript.exe with detached/windowsHide options. The VBS self-deletes and invokes powershell.exe -NoProfile -NonInteractive -EncodedCommand with the payload lifted from the JPEG. The strings powershell.exe, -EncodedCommand, and wscript.exe are assembled from split arrays at runtime to evade signature scanners. The behavior is unrelated to the package's advertised dotenv purpose. The embedded package.json inside dist/cli.cjs identifies the actual codebase as node-env-buffer@2.2.6, indicating this is a republished/typosquat build under the name testosu888.\n","affected":[{"package":{"ecosystem":"npm","name":"testosu888"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.cjs","sha256":"97fa0d7666e80c68a3cd4f3326dc31bd9203619d6bbae7449efe62de15c4e815","tlsh":"4262f784b3dcb03617eb62e190ab4407e9f5da95408c1418f294e4bb35e46db42fbf79"},{"path":"dist/stest.jpg","sha256":"7d893367efc0188f70484db358c807b4046fe2a62c23caec88d82e21fa265609","tlsh":"2154232d75839b34a7acc0e931c27595cf3c29b2f04dc61b4336b6744ea22175ea9da2"},{"path":"dist/cli.cjs","sha256":"8556eeca50285aea12dfdcbc4ebcee110d916ef81ddde2e338dcf78bda2028cf","tlsh":"d792d74473cdb47a17e621d070ab500beaf2cb60459c1504f2dcb07627f4a9a96ebfb9"}],"package_integrity":[{"filename":"testosu888-1.0.0.tgz","hashes":{"sha1":"3e703a0860da5a78787929750c51968d4474780d","sha512_sri":"sha512-YZ7KLOlCBPm4PE6PjA4e+7HVYzWhVvfCrBfinQJLSJ2NovHaCUTXpdrjY/pWzYPjhUJhS7LAgiXTDQ6xfbjhUg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/testosu888/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020689","import_time":"2026-09-29T23:17:35.000688428Z","modified_time":"2026-09-29T23:05:10Z","sha256":"3faa5787fbebe8c5d73f3291c77975efb91c504dddf6a1d82cbe7e9f25372b27","source":"amazon-inspector","versions":["1.0.0"]}]}}