data-pipeline-testmetest

Details

**Severity:** Critical

**Affected versions:** `= 2.0.1`

data-pipeline-testmetest 2.0.1 is a self-spreading credential stealer that runs on `npm install` without an install script: its `binding.gyp` source `<!(env node index.js >/dev/null 2>&1; echo stub.c)` makes node-gyp run `index.js`, an obfuscated loader that decrypts a 939 KB payload and pipes it into Bun (downloaded from GitHub if missing). The payload steals GitHub, npm, PyPI, RubyGems and cloud credentials, commits them to a public repository it creates in the victim's GitHub account (description `project-utils`), and republishes the victim's packages with the same hook. Published by npm account `testnewtestme2` on 2026-10-21.

If it finds a GitHub token it installs a `net-health-checker` user service that runs `rm -rf ~/` once the token is revoked. Remove `~/.local/bin/net-health-checker.sh` and its systemd unit or LaunchAgent before revoking the token, then rotate all reachable credentials.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/d00528d10daab38eadcbc9a9c17890a17aa25e95/osv/malicious/npm/data-pipeline-testmetest/MAL-2026-18177.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/d00528d10daab38eadcbc9a9c17890a17aa25e95/osv/malicious/npm/data-pipeline-testmetest/MAL-2026-18177.json
- https://www.npmjs.com/package/data-pipeline-testmetest/v/2.0.1
- https://github.com/ossf/malicious-packages/blob/f17c406fb7ee5243da902499814340765fd9b86a/osv/malicious/npm/data-pipeline-testmetest/MAL-2026-18177.json
- https://github.com/advisories/GHSA-6cj6-rwg9-r9jc

Compromised versions (1)

• = 2.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.