npm · Malicious package advisory
Malware@testrelic/playwright-analytics
GHSA-73rf-vqvh-pc36
Malicious code in @testrelic/playwright-analytics (npm)
Details
**Severity:** Critical
**Affected versions:** `= 2.13.0`
## Source: amazon-inspector (c305bbe247587c98b06f039cdcf78066dbcd4fdacf5a5de0411023c2a4fcc97a)
scripts/postinstall.cjs is registered as the package's postinstall lifecycle script and runs automatically on `npm install`. After a block of legitimate-looking config-scaffolding code, the file contains roughly 7 KB of whitespace padding followed by an obfuscated payload that reconstructs a large string via a custom Fisher–Yates shuffle, resolves the String `constructor` property (Function) to avoid any literal `Function`/`eval` token, and invokes `Function('', decodedBody)(decodedArg)`. Immediately before the invocation the script assigns `require`, `module`, `__dirname`, and `__filename` onto the global object so the decoded body can load arbitrary Node built-ins. The whitespace gap conceals the payload from casual review of the file, and the indirection through `String[constructor]` avoids the literal tokens static reviewers grep for. The bundled `dist/index.cjs`, `dist/reporter-entry.cjs`, and `dist/cli.cjs` additionally contain `require('child_process')` alongside outbound HTTP POST call sites and `ping` invocations. The package's declared identity (a Playwright analytics reporter under an unfamiliar `@testrelic` scope) is inconsistent with shipping an obfuscated postinstall dynamic-code loader.
---
Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/ac325928d7d4d5dded4b1304b835901bf84d96db/osv/malicious/npm/@testrelic/playwright-analytics/MAL-2026-15565.json))
**References:**
- https://github.com/ossf/malicious-packages/blob/ac325928d7d4d5dded4b1304b835901bf84d96db/osv/malicious/npm/@testrelic/playwright-analytics/MAL-2026-15565.json
- https://www.npmjs.com/package/@testrelic/playwright-analytics/v/2.13.0
- https://github.com/advisories/GHSA-73rf-vqvh-pc36Compromised versions (1)
- = 2.13.0
Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.