rust-testing-utils

Details

**Severity:** Critical

**Affected versions:** `= 2.3.0`

## Source: amazon-inspector (ee33bdedc7938508bcb50e053c441770948d3d69a51c5cab5d4280d84ceffa65)
The package impersonates the pino logger in its README, keywords, and API surface. index.js exports middleware that spawns lib/caller.js as a detached child process on invocation. caller.js reconstructs a hardcoded URL by base64-decoding a value stored under a fake `process.env.DEV_API_KEY` inside a fabricated `process` object, resolving to https://api.jsonstorage.net/v1/json/2ef8c758-a96f-459e-b036-b3b90379a165/f89e8264-86c2-4684-94da-c3f82d59370f. It fetches this URL with axios and passes the returned `cookie` field to `new Function.constructor("require", s)`, then invokes the resulting function with `require` as an argument, giving the remotely fetched code arbitrary execution with full module-loading capability in the consumer's process. The endpoint content is attacker-controlled and mutable, so the executed payload can change at any time without a package update. The base64-encoded URL, fabricated env-var names used to hide the destination, and pino-lookalike cover story are consistent with an intentional supply-chain attack rather than legitimate functionality.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/51911d234a84078e05bdf54c4b86161625e68d64/osv/malicious/npm/rust-testing-utils/MAL-2026-14374.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/51911d234a84078e05bdf54c4b86161625e68d64/osv/malicious/npm/rust-testing-utils/MAL-2026-14374.json
- https://www.npmjs.com/package/rust-testing-utils/v/2.3.0
- https://github.com/advisories/GHSA-mgfq-rgcw-ff87

Compromised versions (1)

• = 2.3.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.