MalwarePublished 18 Sep 2026

test899-auth (npm) · Malicious Code

Affects test899-authSource GCVE Database

Malicious package : remove test899-auth and rotate any secrets on hosts that installed it.

Data as of 19 Sep 2026, 01:35 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-16285

What to do

Remove test899-auth from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmtest899-auth	Affected =1.0.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'test899-auth' version 1.0.1 contains malicious code that executes during installation. It collects detailed host and user identity information and exfiltrates it via DNS queries to a malicious domain, bypassing typical HTTP egress filtering. The package also has a self-referential dependency, indicating it may be a proof-of-concept or malicious probe rather than a legitimate authentication library. Installation of this package compromises the host, and removal may not fully restore system integrity.

Impact

Any system that installs or runs this package is considered fully compromised. Sensitive information about the host and user is leaked to an attacker-controlled domain. The attacker may have gained persistent control, and secrets or keys stored on the compromised system should be considered exposed and rotated immediately. Removal of the package alone does not guarantee elimination of all malicious artifacts or backdoors.

Defensive guidance

Immediate removal of the 'test899-auth' package version 1.0.1 is recommended. All secrets, credentials, and keys stored on the affected system should be rotated from a different, trusted machine. Due to the high likelihood of full system compromise, a full system audit and potential rebuild may be necessary.

Summary

The 'test899-auth' npm package version 1.0.1 includes a preinstall script that gathers sensitive system information such as hostname, platform, OS release, user identity, and system details. This data is base64-encoded, split into DNS labels, and exfiltrated through DNS queries to a hardcoded subdomain controlled by an attacker, effectively bypassing HTTP egress filtering. The package.json declares an unpinned self-dependency, consistent with a malicious or research probe package. Multiple sources, including Amazon Inspector, GHSA malware database, and OpenSSF Package Analysis, classify this package as malicious due to its behavior and communication with a known malicious domain.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 19 Sep 2026, 01:35 UTC

Technical details

References

Community reviews