test_adminet (npm) · Malicious Code
Affects test_adminetSource GCVE Database
Malicious package : remove test_adminet and rotate any secrets on hosts that installed it.
Data as of 14 Jul 2026, 09:48 UTC
Malicious package
Published to npm · OSV MAL-2026-10509
What to do
Remove test_adminet from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmtest_adminet | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package 'test_adminet' version 99.9.9 contains malicious code that executes automatically during installation. It runs a preinstall script that collects sensitive system information and files, including local user and host identifiers and contents of /etc/passwd, /etc/hosts, and /etc/shadow. The collected data, including password hashes if run with root privileges, is exfiltrated via a crafted HTTP request to a hardcoded external endpoint. This behavior occurs without user interaction during a standard npm install.