MAL-2026-16317
Malicious code in testmgkregme (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (496e8021fd5e2626c503e2ceeed8349ff15c68c71a5f19d8a57c67e5f1b41863) npm package testmgkregme@1.0.1 uses a binding.gyp whose `sources` field employs GYP command-expansion (`<!(env node index.js...; echo stub.c)`) to run `node index.js` during `node-gyp rebuild`, which npm invokes automatically when a binding.gyp is present. No native source files (.c/.cc/.cpp/.h) are shipped, so the binding.gyp exists solely to trigger install-time code execution rather than to build a native addon. The executed index.js is a 2.9 MB single-IIFE wrapper: an outer Caesar-cipher (ROT k=4) layer is passed to `eval`, and the decoded body then AES-128-GCM-decrypts hardcoded hex ciphertexts with a hardcoded key/IV/authTag and `eval`s the plaintext. The multi-layer ROT->eval->AES->eval construction has no legitimate purpose and conceals the runtime payload from static review. The result is that `npm install testmgkregme` causes opaque attacker-authored JavaScript to execute on the installer's machine with the installer's privileges.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for testmgkregme (npm). Pin to a known-safe version or switch to an alternative.