Malicious code in log-rotate-testmetest (npm)

The 'log-rotate-testmetest' npm package version 1.0.1 includes a binding.gyp file with a 'sources' field that uses GYP command expansion to execute 'index.js' at install time via npm's implicit 'node-gyp rebuild' process. The 'index.js' file contains a Caesar+10 (ROT) obfuscated eval blob which, when decoded, AES-128-GCM decrypts a hardcoded ciphertext combined with a sibling 'data.bin' file. The decrypted data is then brotli-decompressed, written to a temporary file, and executed using the Bun runtime through 'Bun.spawn'. This multi-layer obfuscation and use of an alternate runtime for execution has no legitimate native build justification and is fully attacker-controlled, representing a malicious package designed to execute hidden payloads during installation.

The malicious package can execute arbitrary, attacker-controlled code on the system during installation, potentially leading to full compromise of the environment where the package is installed. The use of multi-layer obfuscation and an alternate runtime (Bun) complicates detection and analysis. No known exploits in the wild have been reported yet.

No official patch or remediation is currently available. Users should avoid installing version 1.0.1 of the 'log-rotate-testmetest' package. Verify package authenticity before installation and consider using trusted package sources or scanning tools to detect malicious packages. Monitor for vendor advisories for any updates or fixes.