LWA-2026-13133 confirmed malware

stream-utils-testmetest@1.0.0

Malicious code in stream-utils-testmetest (npm)

T1195.002 · Compromise Software Supply ChainT1027 · Obfuscated Files or InformationT1140 · Deobfuscate/Decode Files or InformationT1059.007 · JavaScript

Analysis

This package is an inert placeholder: stream-utils-testmetest@1.0.0 contains only a 21-byte index.js (`module.exports = {};`) and a package.json with no scripts, no bin entries, no dependencies and no repository. It ships no executable payload and makes no network requests. It is published under the same name family as event-emitter-testmetest@1.0.6, which does carry a payload: a 689KB single-line index.js that decodes a Caesar-shifted source string and passes it to eval() at load time. The decoded source requires the crypto module, builds an AES-128-GCM decipher from hardcoded hex key, IV and auth-tag values, and eval()s the decrypted result — an encrypted second stage whose executed code is not visible in the file. The placeholder versions reserve the package names for that loader family.

analyzed by
Leitwacht
first seen
Oct 21, 2026, 12:19 PM
analyzed
Oct 21, 2026, 12:20 PM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.