testmgkregme

GHSA-hc49-rwm2-p2w7

Malicious code in testmgkregme (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.1`

## Source: amazon-inspector (496e8021fd5e2626c503e2ceeed8349ff15c68c71a5f19d8a57c67e5f1b41863)
npm package [email protected] uses a binding.gyp whose `sources` field employs GYP command-expansion (`<!(env node index.js...; echo stub.c)`) to run `node index.js` during `node-gyp rebuild`, which npm invokes automatically when a binding.gyp is present. No native source files (.c/.cc/.cpp/.h) are shipped, so the binding.gyp exists solely to trigger install-time code execution rather than to build a native addon. The executed index.js is a 2.9 MB single-IIFE wrapper: an outer Caesar-cipher (ROT k=4) layer is passed to `eval`, and the decoded body then AES-128-GCM-decrypts hardcoded hex ciphertexts with a hardcoded key/IV/authTag and `eval`s the plaintext. The multi-layer ROT->eval->AES->eval construction has no legitimate purpose and conceals the runtime payload from static review. The result is that `npm install testmgkregme` causes opaque attacker-authored JavaScript to execute on the installer's machine with the installer's privileges.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/5f0495009882359c4fb90f43d4c686a809dd861a/osv/malicious/npm/testmgkregme/MAL-2026-16317.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/5f0495009882359c4fb90f43d4c686a809dd861a/osv/malicious/npm/testmgkregme/MAL-2026-16317.json
- https://www.npmjs.com/package/testmgkregme/v/1.0.1
- https://github.com/advisories/GHSA-hc49-rwm2-p2w7

Compromised versions (1)

= 1.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.