pixel-map-testmetest

GHSA-26g3-4jrv-x55w

Malicious code in pixel-map-testmetest (npm)

Details

**Severity:** Critical

**Affected versions:** `= 0.0.1`

pixel-map-testmetest 0.0.1 and 0.0.2 ship a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and run it on `npm install`: their `binding.gyp` source `<!(env node index.js >/dev/null 2>&1; echo stub.c)` makes node-gyp run `index.js`, which decrypts `data.bin` and pipes it into Bun. The package.json poses as an npm staged-publishing placeholder (`"stub": true`, "Temporary package placeholder for staged publishing"). Published by npm account `newtestnewdont` on 2026-10-21 after a benign 1.0.0; the same account published benign-looking color-utils-testmetest, string-helpers-testmetest and byte-stride-testmetest. 0.0.2 (published 3.5 hours after 0.0.1) is the same loader and hook with a re-encrypted, additionally obfuscated payload.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/d00528d10daab38eadcbc9a9c17890a17aa25e95/osv/malicious/npm/pixel-map-testmetest/MAL-2026-18180.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/d00528d10daab38eadcbc9a9c17890a17aa25e95/osv/malicious/npm/pixel-map-testmetest/MAL-2026-18180.json
- https://www.npmjs.com/package/pixel-map-testmetest/v/0.0.1
- https://www.npmjs.com/package/pixel-map-testmetest/v/0.0.2
- https://github.com/ossf/malicious-packages/blob/f17c406fb7ee5243da902499814340765fd9b86a/osv/malicious/npm/pixel-map-testmetest/MAL-2026-18180.json
- https://www.npmjs.com/package/pixel-map-testmetest/v/0.0.3
- https://github.com/advisories/GHSA-26g3-4jrv-x55w

Compromised versions (1)

= 0.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.