MalwarePublished 29 Oct 2026

@testsecuiitytestme/cache-helper (npm) · Malicious Code

Affects @testsecuiitytestme/cache-helperSource GCVE Database

Malicious package : remove @testsecuiitytestme/cache-helper and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 14:20 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18358

What to do

Remove @testsecuiitytestme/cache-helper from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@testsecuiitytestme/cache-helper	Affected 1.0.1 – 1.0.7 7 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @testsecuiitytestme/cache-helper is a malicious package that installs a credential stealer and self-propagating worm. It executes a native addon at install time that loads an obfuscated Bun program to collect a wide range of credentials and secrets from developer machines. The malware targets credentials from npm, GitHub, GitLab, PyPI, RubyGems, cloud providers (AWS, GCP, Azure), HashiCorp Vault, Kubernetes, SSH keys, browser logins, and password managers. It also propagates by publishing malicious packages and injecting CI/CD workflow changes and AI assistant configurations. The package was published and updated multiple times on October 27, 2026, then unpublished shortly after. Users who installed any version should consider all accessible credentials compromised and rotate them immediately.

Impact

This malware compromises developer machines by stealing a broad range of credentials and secrets, including tokens for npm, GitHub, GitLab, PyPI, RubyGems, cloud providers, and password managers. It enables attackers to access and potentially manipulate source code repositories, cloud infrastructure, and package registries. The worm-like propagation can lead to widespread compromise of developer environments and software supply chains. Any credentials accessible from an infected machine should be considered exposed and rotated immediately. The malware also risks unauthorized package publishing and injection of malicious CI/CD workflows, increasing the attack surface and potential for further compromise.

Defensive guidance

The malicious package @testsecuiitytestme/cache-helper has been unpublished from npm. Users who installed any version (=1.0.1 through =1.0.7) should treat all credentials accessible from the affected machine as compromised. Immediate rotation of npm, GitHub, cloud provider tokens, and other secrets is strongly recommended. Users should audit their package releases and repository workflows for unauthorized changes. Avoid installing packages from untrusted or unknown publishers and verify package integrity before use.

Summary

The @testsecuiitytestme/cache-helper npm package is a malicious software supply chain attack that installs a credential stealer and worm on developer machines. It uses a native addon loaded during installation to run an obfuscated Bun runtime program that collects extensive credentials and secrets from various developer tools, cloud services, and password managers. The malware detects CI, container, and debugger environments to avoid execution in those contexts. It propagates by publishing malicious packages to npm, PyPI, and RubyGems, injecting malicious workflows into GitHub and GitLab CI pipelines, and modifying AI coding assistant configurations. The package was rapidly published in multiple versions on October 27, 2026, then unpublished. Static analysis confirmed the presence of credential theft and propagation mechanisms, though no active exploitation in the wild is confirmed.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 14:20 UTC

Technical details

References

Community reviews