test12vv36

GHSA-7f39-795r-gxj4

Malicious code in test12vv36 (npm)

Details

**Severity:** Critical

**Affected versions:** `= 99.99.99`

## Source: amazon-inspector (9292921d0fe368160694717f99eca753070a4249696c72b2f1bff9594cab40be)
[email protected] declares both preinstall and postinstall lifecycle hooks that execute index.js on npm install. index.js issues an HTTP GET to a hardcoded bare-IP endpoint at http://128.199.122.145/?test12vv36, sending the package name in the query string and disclosing the installer's source IP to the operator of that host. The version number (99.99.99) and package.json shape (dependency on a typosquat name 'requests@^0.3.0' plus a duplicate misspelled 'Dependencies' key) are consistent with a dependency-confusion or proof-of-concept publish rather than a functional library. Installing the package causes unauthenticated, unencrypted outbound network activity to attacker-controlled infrastructure at install time, confirming successful installation on the host.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/5f0495009882359c4fb90f43d4c686a809dd861a/osv/malicious/npm/test12vv36/MAL-2026-16311.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/5f0495009882359c4fb90f43d4c686a809dd861a/osv/malicious/npm/test12vv36/MAL-2026-16311.json
- https://www.npmjs.com/package/test12vv36/v/99.99.99
- https://github.com/advisories/GHSA-7f39-795r-gxj4

Compromised versions (1)

= 99.99.99

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.