teahy-znrpz-util (npm) · Malicious Code
Affects teahy-znrpz-utilSource GCVE Database
Malicious package : remove teahy-znrpz-util and rotate any secrets on hosts that installed it.
Data as of 11 Nov 2026, 22:20 UTC
Malicious package
Published to npm · OSV MAL-2026-19146
What to do
Remove teahy-znrpz-util from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmteahy-znrpz-util | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (5d18143cb6c6ab53a6b224630d1b50f00578f4308414da4f384281a679d7861d) index.js reads a numeric byte array stored under a non-standard `_bz` key inside package.json, decompresses it with zlib.inflateSync, and executes the resulting string via the Function constructor with `require` and `__dirname` bound in — all on module load. Execution is gated by an early-return when any of CI, GITHUB_ACTIONS, GITLAB_CI, TRAVIS, CIRCLECI, or SANDBOX environment variables are set, so the hidden code only runs on real developer or production hosts. Smuggling executable logic as a zlib blob under a private manifest key, decoding it, and running it through Function() at require time is an obfuscated-loader pattern; the package's self-description as a 'utility' does not match any behavior visible in its source. The payload executes with full Node privileges on the installer's machine as soon as the module is required.