Malicious code in data-pipeline-testmetest (npm)

The data-pipeline-testmetest npm package version 2.0.1 is a malicious package that achieves install-time code execution by abusing the binding.gyp file's command expansion feature to run an obfuscated JavaScript loader during the implicit node-gyp rebuild step. The loader decrypts a large AES-128-GCM encrypted payload that steals various credentials (GitHub, npm, PyPI, RubyGems, cloud) and exfiltrates them by creating a public repository in the victim's GitHub account. It also propagates by republishing victim packages with the same malicious hook. Additionally, if a GitHub token is detected, it installs a user service named net-health-checker that deletes the user's home directory upon token revocation. The package was published by the npm account testnewtestme2 on 2026-10-21. The presence of an unrelated Bun runtime dependency and multi-layer obfuscation confirms the package's loader/dropper nature rather than a legitimate utility.

This malicious package compromises user credentials across multiple package repositories and cloud services, leading to credential theft and potential account takeover. The attacker gains persistent access by creating public repositories in the victim's GitHub account and propagates the infection by republishing victim packages with the malicious hook. The installed net-health-checker service poses a destructive risk by deleting the user's home directory if the GitHub token is revoked without prior removal of the service. This can cause significant data loss and operational disruption.

No official patch is indicated. Users should immediately remove the net-health-checker user service script (~/.local/bin/net-health-checker.sh) and its systemd unit or LaunchAgent before revoking any GitHub tokens associated with the affected environment to prevent destructive deletion of the home directory. After removal, rotate all reachable credentials including GitHub, npm, PyPI, RubyGems, and cloud service tokens. Avoid installing or using the data-pipeline-testmetest package version 2.0.1. Monitor for any unauthorized public repositories created in user GitHub accounts. Since this is a malicious package published on npm, report it to npm security teams for removal.