MalwarePublished 5 Aug 2026Updated 1 Sep 2026

gs-uitk-testing-utils (npm) · Malicious Code

Affects gs-uitk-testing-utilsSource GCVE Database

Malicious package : remove gs-uitk-testing-utils and rotate any secrets on hosts that installed it.

Data as of 12 Sep 2026, 07:16 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12792

What to do

Remove gs-uitk-testing-utils from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmgs-uitk-testing-utils	Affected =9.9.11	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package gs-uitk-testing-utils version 9.9.11 contains malicious code that executes during installation and when required. It collects host-identifying information including the OS username, hostname, and current working directory name, combines this data with a hardcoded campaign marker and timestamp, and exfiltrates it via DNS queries to a suspicious external domain. The code uses obfuscation techniques to evade static detection. This behavior is consistent with dependency confusion attacks targeting a specific organization. No patch or fix information is provided.

Impact

This malicious package leaks sensitive host-identifying information to an attacker-controlled domain during installation and usage, potentially enabling targeted reconnaissance and further attacks against the affected organization. The exfiltration of OS username, hostname, and working directory information compromises host privacy and security posture. There is no indication of direct code execution beyond the exfiltration, but the presence of such a backdoor in a dependency can facilitate broader compromise.

Defensive guidance

Users should avoid installing or requiring gs-uitk-testing-utils version 9.9.11. Audit dependencies for typosquatting or dependency confusion risks. Monitor for suspicious DNS queries to domains like oob.sl4x0.xyz. Remove the affected package from projects and replace it with trusted versions or alternatives. Check vendor advisories or npm security advisories for updates.

Summary

The gs-uitk-testing-utils package at version 9.9.11 declares an npm install lifecycle script that runs node index.js, which loads a module that collects the installer's OS username, hostname, and current working directory basename. This data is concatenated with a hardcoded campaign marker 'goldman2' and a timestamp, then exfiltrated via DNS resolution queries to a subdomain of oob.sl4x0.xyz. The code reconstructs key strings at runtime from character code arrays to evade static analysis. The package name mimics an internal UI toolkit namespace, and the author email domain matches the exfiltration domain, indicating targeted dependency confusion reconnaissance. The exfiltration triggers automatically on npm install and on require of the package.

References

npmjs.com/package/gs-uitk-testing-utils/v/9.9.11 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Sep 2026, 07:16 UTC

Technical details

References

Community reviews