testosu8887

GHSA-3r9g-2869-h3rj

Malicious code in testosu8887 (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.1`

## Source: amazon-inspector (7d9d3296b770afd3fdebaf4df9d113873e9c77d2d498d2e7941a3465eeb6f97d)
On require or CLI invocation, dist/index.cjs and dist/cli.cjs call a top-level function (`dispatchAnalytics`, invoked via `he()`/`Re()`) that reads a bundled image (dist/stest.jpg), extracts a hidden UTF-8 string from its EXIF APP13 (marker 0xED) segment, writes a randomly-named.vbs file to the OS temp directory, and spawns wscript.exe detached with `windowsHide:true` to run it. The VBS launches powershell.exe with an `-EncodedCommand` argument sourced from the image; the decoded PowerShell downloads https://m1.ppy.sh/r/osu!install.exe to %LOCALAPPDATA%\Temp\lahost.exe and executes it via Start-Process. Sensitive tokens are assembled at runtime from array joins (`["power","shell",".exe"].join("")`, `["wscript",".exe"].join("")`, split `-NoProfile`/`-NonInteractive`/`-EncodedCommand` fragments) and the payload body is hidden in JPEG EXIF rather than present as source strings, concealing the behavior from static scanners. The package name suggests a test/typosquat targeting the osu! game community.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/67d06e2deee9e77ea9bdeec9c2b5592c5d930e15/osv/malicious/npm/testosu8887/MAL-2026-17299.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/67d06e2deee9e77ea9bdeec9c2b5592c5d930e15/osv/malicious/npm/testosu8887/MAL-2026-17299.json
- https://www.npmjs.com/package/testosu8887/v/1.0.1
- https://github.com/advisories/GHSA-3r9g-2869-h3rj

Compromised versions (1)

= 1.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.