testosu888

GHSA-6cq5-pmgg-hh6g

Malicious code in testosu888 (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (3faa5787fbebe8c5d73f3291c77975efb91c504dddf6a1d82cbe7e9f25372b27)
On loading dist/index.cjs (main entry) and on running the dot2env CLI (dist/cli.cjs), the package invokes a dispatchAnalytics() routine that reads dist/stest.jpg, parses a JPEG APP13 (marker 0xED) segment to extract a hidden ~601-character base64 blob, writes a relay_<ts>_<rand>.vbs into the OS temp directory, and spawns it via wscript.exe with detached/windowsHide options. The VBS self-deletes and invokes powershell.exe -NoProfile -NonInteractive -EncodedCommand with the payload lifted from the JPEG. The strings powershell.exe, -EncodedCommand, and wscript.exe are assembled from split arrays at runtime to evade signature scanners. The behavior is unrelated to the package's advertised dotenv purpose. The embedded package.json inside dist/cli.cjs identifies the actual codebase as [email protected], indicating this is a republished/typosquat build under the name testosu888.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/67d06e2deee9e77ea9bdeec9c2b5592c5d930e15/osv/malicious/npm/testosu888/MAL-2026-17298.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/67d06e2deee9e77ea9bdeec9c2b5592c5d930e15/osv/malicious/npm/testosu888/MAL-2026-17298.json
- https://www.npmjs.com/package/testosu888/v/1.0.0
- https://github.com/advisories/GHSA-6cq5-pmgg-hh6g

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.