test1ro

GHSA-8rr3-xrmc-xvjf

Malicious code in test1ro (npm)

Details

**Severity:** Critical

**Affected versions:** `= 999.99.99`

## Source: amazon-inspector (8166d7eaf8dab64a6c21d0e0a871c64e213147082a414b93816fb080c8044b1e)
package.json declares preinstall and postinstall hooks that run `node index.js`, which reads `os.hostname()` and issues an HTTP GET to the hardcoded third-party collector `http://eo8f3m3ho26a0nm.m.pipedream.net/<package>?h=<hostname>`. The behavior fires automatically during `npm install` without any user action, transmitting the installer's host identifier and the resolved package name to an external Pipedream request-bin. The manifest also declares `test1ro: ^999.99.99` as its own dependency at an implausibly high version, characteristic of a dependency-confusion artifact designed to be resolved from public npm ahead of an internal package of the same name. The generic name, self-referential high-version pin, and install-time beacon to an attacker-controlled collector match the standard dependency-confusion probe shape.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/5f0495009882359c4fb90f43d4c686a809dd861a/osv/malicious/npm/test1ro/MAL-2026-16315.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/5f0495009882359c4fb90f43d4c686a809dd861a/osv/malicious/npm/test1ro/MAL-2026-16315.json
- https://www.npmjs.com/package/test1ro/v/99.99.99
- https://www.npmjs.com/package/test1ro/v/999.99.99
- https://github.com/advisories/GHSA-8rr3-xrmc-xvjf

Compromised versions (1)

= 999.99.99

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.