Malicious code in pixel-map-testmetest (npm)

The pixel-map-testmetest npm package versions 0.0.1 and 0.0.2 abuse the node-gyp build process by using a binding.gyp file that executes a node script (index.js) during installation. This script decrypts an AES-128-GCM encrypted and brotli-compressed payload (data.bin) using hardcoded keys, writes it to a temporary directory, and runs it with the Bun runtime, which is declared as a dependency. The payload is a credential stealer originally from data-pipeline-testmetest 2.0.1. The package.json falsely claims to be a temporary placeholder, but the tarball includes the obfuscated loader and encrypted payload, indicating malicious intent. The account publishing these packages also published other benign-looking packages, suggesting a staged attack pattern. Version 0.0.2 adds further obfuscation to the payload. This technique bypasses typical Node.js inspection by executing code at install time and using an alternate runtime.

Installation of pixel-map-testmetest versions 0.0.1 and 0.0.2 results in execution of a credential-stealing payload on the victim's system. The payload is delivered through an obfuscated, encrypted blob decrypted and executed during npm install, potentially compromising user credentials or sensitive data. The use of an alternate runtime (Bun) and multi-layer obfuscation complicates detection and analysis, increasing the risk of unnoticed compromise.

No official patch or remediation is currently documented. Users should avoid installing pixel-map-testmetest versions 0.0.1, 0.0.2, and 0.0.3. Audit and remove these packages if present. Monitor for suspicious activity related to credential theft. Since this is a malicious package published on npm, rely on npm advisories and block or remove the package from internal registries. Consider using package integrity verification and restrict installation of unknown or suspicious packages.