testis-pack

Details

The npm package `testis-pack` presents itself as a small binary packing/checksum utility (`pack`/`unpack`/`checksum`/`inspect`) but embeds an obfuscated dropper. It declares a `preinstall: node index.js` hook. The strings for the C2 host, path and dropped-binary name are not present in plaintext — they are reconstructed at runtime via `String.fromCharCode()` calls over hardcoded integer arrays, decoding to the host `sloth-antagonist.vercel.app`, path `/service/assets/fetchBinary` (Windows) or `/service/assets/fetchLinuxBinary` (Linux), and destination filenames `WinService.exe` (Windows) / `WinMetrics` (Linux) written into `%LOCALAPPDATA%\Programs\WinMetrics` or `$HOME/.local/share/WinMetrics` respectively — names chosen to masquerade as a legitimate Windows telemetry/service binary. When triggered, the code downloads the file from `https://sloth-antagonist.vercel.app/service/assets/fetch(Linux)Binary`, `chmod`s it executable on Linux, then spawns it detached and unref'd (`stdio: 'ignore'`, `windowsHide: true` on Windows) so it runs silently in the background, disconnected from the parent process. The routine is skipped on macOS.

Note on the trigger: unlike many install-hook droppers, the fetch-and-execute routine (`_fetch()`) is not invoked at the top level of `index.js` — there is no unconditional call anywhere in the module. It is instead called as the first statement inside the exported `pack()` function, so the bare `node index.js` invocation performed by the `preinstall` hook only defines and exports the functions without itself triggering the download. The dropper fires as a side effect the first time any downstream code calls the package's own `pack()` API — which is the package's entire ostensible purpose, making activation highly likely for any real consumer while still evading naive "executes immediately on install" detections. The package was published by npm user `ioa2102` (`anamora.les.24948@gmail.com`), which also published the near-identical `testudo-pack` (same payload, `postinstall` hook instead of `preinstall`).

Analysis performed via static review only (npm registry metadata and package source retrieved as text via the npm registry and unpkg CDN) — the package was not installed or executed.

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (96f8bc8284635b679a5ca943750a4d3386f73539e05352fd4cd6b0da5d01496f)
package.json declares a preinstall hook (`node index.js`) that runs automatically on `npm install`. index.js assembles the destination host, URL path, and dropped filename from `String.fromCharCode` numeric arrays to hide them from string scanners; the reconstructed values are the host `sloth-antagonist.vercel.app` and paths `/service/assets/fetchBinary` (Windows) and `/service/assets/fetchLinuxBinary` (Linux). The script downloads the unpinned, unverified binary via `https.get(...).pipe(createWriteStream(dest))`, writing it to `%LOCALAPPDATA%\Programs\WinMetrics\WinService.exe` on Windows or `~/.local/share/WinMetrics/WinMetrics` on Linux — cover names that impersonate a Windows system component. The file is then `chmod 0755`ed and launched via `spawn(dest, [], { detached: true, stdio: 'ignore', windowsHide: true }).unref()`, so it survives the install process and runs silently in the background under the installing user's privileges. The exported `pack()` API triggers the same fetch-and-execute path on any call, so `require('testis-pack')` also delivers the payload. The dropped bytes are attacker-controlled and mutable at the host, giving the publisher open-ended remote code execution on every installer's machine.

Compromised versions (1)

• 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.