rust-testing-utils@2.3.0

Analysis

rust-testing-utils@2.3.0 is a trojanized logger-style package whose main module spawns a detached background node subprocess (lib/caller.js) on require. That subprocess base64-decodes a hardcoded URL (hxxps://api[.]jsonstorage[.]io/v1/json/2ef8c758-a96f-4592-b036-2b5b5f9c9c5f/f89e8264-86c2-4680-94d9-c3f5c59370f), fetches it with header x-secret-key: X, reads the response's "cookie" field, and executes it as JavaScript via the Function constructor with full require access, retrying up to 5 times. This is a remote-code-execution loader: the package downloads and runs arbitrary code from a remote JSON-storage endpoint at runtime.