stream-utils-testmetest@1.0.0
Malicious code in stream-utils-testmetest (npm)
Analysis
This package is an inert placeholder: stream-utils-testmetest@1.0.0 contains only a 21-byte index.js (`module.exports = {};`) and a package.json with no scripts, no bin entries, no dependencies and no repository. It ships no executable payload and makes no network requests. It is published under the same name family as event-emitter-testmetest@1.0.6, which does carry a payload: a 689KB single-line index.js that decodes a Caesar-shifted source string and passes it to eval() at load time. The decoded source requires the crypto module, builds an AES-128-GCM decipher from hardcoded hex key, IV and auth-tag values, and eval()s the decrypted result — an encrypted second stage whose executed code is not visible in the file. The placeholder versions reserve the package names for that loader family.
- analyzed by
- Leitwacht
- first seen
- Oct 21, 2026, 12:19 PM
- analyzed
- Oct 21, 2026, 12:20 PM
Related advisories
- data-pipeline-testmetest@2.0.1
- casamare@1.0.0
- @apollolibraryorg/dotenv@1.0.2
- chai-as-indexed@6.0.5
- cputil-node@0.6.6
- hardhat-bits@2.21.0
- random-certs@0.0.1
- dotenv-runtime@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.