Malicious code in test-brotli-testmetest (npm)

The test-brotli-testmetest 1.0.0 npm package includes a binding.gyp file that abuses GYP command expansion to execute a JavaScript file (index.js) during the node-gyp rebuild step of installation. The binding.gyp's sources field uses shell command expansion to run 'node index.js', which is an obfuscated loader approximately 586KB in size. This loader decodes a Caesar-shifted character array, then uses AES-128-GCM with hardcoded keys to decrypt a large ciphertext payload. The decrypted payload is executed asynchronously and silently, representing a classic install-time dropper that runs attacker-supplied code during 'npm install' with no transparency. No legitimate native build occurs, indicating the sole purpose is malicious code execution.

The malicious package executes arbitrary code on the system during installation, potentially allowing credential theft or other attacker actions without user awareness. This compromises the security of any environment where the package is installed, leading to possible credential exposure and system compromise.

No official patch or remediation is currently documented. Users should avoid installing test-brotli-testmetest version 1.0.0. Since the package runs malicious code at install time, removing or blocking this package from dependency trees is recommended. Monitor for updates or advisories from npm or the package maintainer for remediation.