MalwarePublished 5 Aug 2026Updated 21 Aug 2026

saas-f-testing (npm) · Malicious Code

Affects saas-f-testingSource GCVE Database

Malicious package : remove saas-f-testing and rotate any secrets on hosts that installed it.

Data as of 21 Aug 2026, 14:53 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12434

What to do

Remove saas-f-testing from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmsaas-f-testing	Affected =20.4.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'saas-f-testing' version 20.4.2 contains malicious code that downloads and executes platform-specific binaries from dynamically assembled and obfuscated hostnames without any signature verification. This behavior results in full system compromise, allowing an attacker to gain control over the affected computer. Immediate removal of the package and rotation of all secrets and keys stored on the compromised system are strongly advised.

Impact

Any system with this package installed or running is considered fully compromised. Attackers may have complete control over the system, potentially accessing all stored secrets and keys. This poses a critical risk to confidentiality, integrity, and availability of the affected environment. Secrets and keys must be rotated from a clean system to prevent further unauthorized access.

Defensive guidance

Remove the 'saas-f-testing' package version 20.4.2 immediately from all affected systems. Rotate all secrets and keys stored on the compromised machines from a separate, trusted environment. Because the package grants full control to an attacker and spawns unsigned executables, simply uninstalling the package may not remove all malicious components. Conduct a thorough investigation and remediation of the affected systems to ensure complete eradication of the threat.

Summary

The 'saas-f-testing' npm package (version 20.4.2) includes code in its main entry point (index.js) that loads setup.js, which downloads a platform-specific executable from runtime-assembled hostnames using obfuscated DNS and HTTP requests. The executable is saved under covert filenames in temporary directories, permissions are set to executable, and it is spawned detached without any hash or signature verification. This allows arbitrary code execution and full compromise of the host system. A secondary file with similar behavior exists but is not reachable in this version. Due to the nature of the compromise, removal of the package alone may not eliminate all malicious artifacts.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 21 Aug 2026, 14:53 UTC

Technical details

References

Community reviews