Malicious code in net-codec-testmetest (npm)

The net-codec-testmetest package (version 1.0.1) includes a binding.gyp file with no native source files but uses GYP command expansion to run an obfuscated JavaScript file (index.js) during the node-gyp rebuild step invoked by npm. This script decrypts an AES-128-GCM encrypted data blob using hardcoded keys, decompresses it with Brotli, and executes the resulting binary under the Bun runtime dependency. This technique leverages install-time execution to smuggle and run a malicious payload, effectively acting as a packed dropper with no legitimate utility.

This malicious package can execute arbitrary code on the system during installation, potentially leading to full system compromise or further payload delivery. Because the payload is encrypted and executed under an alternate runtime, detection and analysis are complicated, increasing the risk of stealthy persistence or additional malicious activity.

No official patch or remediation is currently documented. Users and organizations should avoid installing or using net-codec-testmetest version 1.0.1. Employing package integrity verification, restricting installation of untrusted packages, and monitoring supply chain sources are recommended until an official fix or advisory is released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.