tetotest

GHSA-25v6-77x2-2mwr

Malicious code in tetotest (npm)

Details

**Severity:** Critical

**Affected versions:** `= 14.0.0`

## Source: amazon-inspector (b181542b0c55a472e316ca973cc5b1deaf31986645fd326903e8c31ab20acab6)
package.json declares preinstall and postinstall lifecycle scripts that invoke wget to POST the installer's shell-expanded working directory ($(pwd)) and machine hostname ($(hostname)) to a hardcoded Discord webhook at https://discord.com/api/webhooks/1413937656697720862/<redacted>. Both hooks fire automatically on `npm install` without user interaction. The package ships no library code or documented functionality — its sole effect is beaconing installer host identifiers to an attacker-controlled Discord endpoint.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/7f1aa138541a03139444da6ce5a68c006904fd72/osv/malicious/npm/tetotest/MAL-2026-16217.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/7f1aa138541a03139444da6ce5a68c006904fd72/osv/malicious/npm/tetotest/MAL-2026-16217.json
- https://www.npmjs.com/package/tetotest/v/14.0.0
- https://github.com/advisories/GHSA-25v6-77x2-2mwr

Compromised versions (1)

= 14.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.