Malicious code in test-brotli2-testmetest (npm)

The test-brotli2-testmetest 1.0.0 npm package includes a malicious install script that leverages node-gyp's build process to execute an obfuscated loader script (index.js). The binding.gyp file uses GYP command expansion to run index.js during the configure phase, despite declaring no actual build targets or source files. The loader script is a large Caesar-shifted character array that, when decoded, imports node:crypto to decrypt an AES-128-GCM encrypted payload. This decrypted payload is executed on the installer's machine and functions as a credential stealer. The package was published on 2026-10-21 by the npm user testnewtestme2. No readable logic or URLs are exposed in the source, making the payload opaque and malicious.

Installing this package results in execution of a concealed malicious payload on the installer's machine, which steals credentials. This compromises the security and privacy of the affected system and any credentials stored or accessible during installation.

No official patch or remediation is indicated. Users should avoid installing the test-brotli2-testmetest package version 1.0.0. Remove any installations of this package and audit systems for potential credential compromise. Monitor npm package sources and verify publisher authenticity before installation.