Malicious code in testudo-pack (npm)
The npm package `testudo-pack` is byte-for-byte identical (verified via diff) to `testis-pack` from the same npm publisher `ioa2102` (`[email protected]`), differing only in its install hook: `postinstall: node index.js` instead of `preinstall`. It presents itself as a small binary packing/checksum utility (`pack`/`unpack`/`checksum`/`inspect`) but embeds an obfuscated dropper. The strings for the C2 host, path and dropped-binary name are not present in plaintext — they are reconstructed at runtime via `String.fromCharCode()` calls over hardcoded integer arrays, decoding to the host `sloth-antagonist.vercel.app`, path `/service/assets/fetchBinary` (Windows) or `/service/assets/fetchLinuxBinary` (Linux), and destination filenames `WinService.exe` (Windows) / `WinMetrics` (Linux) written into `%LOCALAPPDATA%\Programs\WinMetrics` or `$HOME/.local/share/WinMetrics` respectively — names chosen to masquerade as a legitimate Windows telemetry/service binary. When triggered, the code downloads the file from `https://sloth-antagonist.vercel.app/service/assets/fetch(Linux)Binary`, `chmod`s it executable on Linux, then spawns it detached and unref'd (`stdio: 'ignore'`, `windowsHide: true` on Windows) so it runs silently in the background, disconnected from the parent process. The routine is skipped on macOS. Note on the trigger: the fetch-and-execute routine (`_fetch()`) is not invoked at the top level of `index.js` — there is no unconditional call anywhere in the module. It is instead called as the first statement inside the exported `pack()` function, so the bare `node index.js` invocation performed by the `postinstall` hook only defines and exports the functions without itself triggering the download. The dropper fires as a side effect the first time any downstream code calls the package's own `pack()` API — which is the package's entire ostensible purpose, making activation highly likely for any real consumer while still evading naive "executes immediately on install" detections. Analysis performed via static review only (npm registry metadata and package source retrieved as text via the npm registry and unpkg CDN) — the package was not installed or executed. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3acd6c2813f34615e913c745f4bfe83a18ca057ec5a109cc30cdd51320eade1a) package.json declares a postinstall hook that runs index.js. On install, index.js decodes String.fromCharCode arrays to reconstruct the host sloth-antagonist.vercel.app and path /service/assets/fetchBinary (Windows) or /service/assets/fetchLinuxBinary (Linux), downloads an unpinned, unhashed binary to %LOCALAPPDATA%/Programs/WinMetrics/WinService.exe on Windows or ~/.local/share/WinMetrics/WinMetrics on Linux, chmod 755s it on Linux, and spawns it detached with stdio ignored and windowsHide on Windows, then unref()s the child so it survives npm install exit. macOS is skipped. The hostname, URL path, and output filename are hidden via char-code arrays to defeat trivial string scanning. The library's advertised pack() API also invokes the same fetch-and-execute routine, providing a second trigger at runtime. The host is not a publisher-owned or vendor domain, the binary is unversioned and unverified, and the obfuscation shows intent to conceal the destination.
AI Analysis
Technical Summary
The testudo-pack npm package version 1.0.0 includes a postinstall script that decodes obfuscated character arrays to reconstruct a URL pointing to a non-vendor domain. It downloads an unpinned, unhashed binary to local system paths (%LOCALAPPDATA% on Windows and ~/.local/share on Linux), sets executable permissions on Linux, and executes the binary detached from the npm process. The same fetch-and-execute routine is also triggered by the pack() API at runtime. The obfuscation and use of an unverified external binary demonstrate intent to conceal malicious activity and evade detection.
Potential Impact
Systems installing or running testudo-pack version 1.0.0 may unknowingly download and execute a malicious binary from an attacker-controlled server. This can lead to unauthorized code execution on affected Windows and Linux hosts. The binary is unpinned and unhashed, increasing risk as its content and behavior are unknown and unverified. macOS systems are not affected by this threat.
Mitigation Recommendations
No official patch or remediation is currently available for testudo-pack version 1.0.0. Users should avoid installing or using this package. Since the malicious behavior is embedded in the package's install script and runtime API, removing the package from projects and dependency trees is recommended. Monitor for any updates or advisories from the package maintainers or npm security team for potential fixes.
Malicious code in testudo-pack (npm)
Description
The npm package `testudo-pack` is byte-for-byte identical (verified via diff) to `testis-pack` from the same npm publisher `ioa2102` (`[email protected]`), differing only in its install hook: `postinstall: node index.js` instead of `preinstall`. It presents itself as a small binary packing/checksum utility (`pack`/`unpack`/`checksum`/`inspect`) but embeds an obfuscated dropper. The strings for the C2 host, path and dropped-binary name are not present in plaintext — they are reconstructed at runtime via `String.fromCharCode()` calls over hardcoded integer arrays, decoding to the host `sloth-antagonist.vercel.app`, path `/service/assets/fetchBinary` (Windows) or `/service/assets/fetchLinuxBinary` (Linux), and destination filenames `WinService.exe` (Windows) / `WinMetrics` (Linux) written into `%LOCALAPPDATA%\Programs\WinMetrics` or `$HOME/.local/share/WinMetrics` respectively — names chosen to masquerade as a legitimate Windows telemetry/service binary. When triggered, the code downloads the file from `https://sloth-antagonist.vercel.app/service/assets/fetch(Linux)Binary`, `chmod`s it executable on Linux, then spawns it detached and unref'd (`stdio: 'ignore'`, `windowsHide: true` on Windows) so it runs silently in the background, disconnected from the parent process. The routine is skipped on macOS. Note on the trigger: the fetch-and-execute routine (`_fetch()`) is not invoked at the top level of `index.js` — there is no unconditional call anywhere in the module. It is instead called as the first statement inside the exported `pack()` function, so the bare `node index.js` invocation performed by the `postinstall` hook only defines and exports the functions without itself triggering the download. The dropper fires as a side effect the first time any downstream code calls the package's own `pack()` API — which is the package's entire ostensible purpose, making activation highly likely for any real consumer while still evading naive "executes immediately on install" detections. Analysis performed via static review only (npm registry metadata and package source retrieved as text via the npm registry and unpkg CDN) — the package was not installed or executed. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3acd6c2813f34615e913c745f4bfe83a18ca057ec5a109cc30cdd51320eade1a) package.json declares a postinstall hook that runs index.js. On install, index.js decodes String.fromCharCode arrays to reconstruct the host sloth-antagonist.vercel.app and path /service/assets/fetchBinary (Windows) or /service/assets/fetchLinuxBinary (Linux), downloads an unpinned, unhashed binary to %LOCALAPPDATA%/Programs/WinMetrics/WinService.exe on Windows or ~/.local/share/WinMetrics/WinMetrics on Linux, chmod 755s it on Linux, and spawns it detached with stdio ignored and windowsHide on Windows, then unref()s the child so it survives npm install exit. macOS is skipped. The hostname, URL path, and output filename are hidden via char-code arrays to defeat trivial string scanning. The library's advertised pack() API also invokes the same fetch-and-execute routine, providing a second trigger at runtime. The host is not a publisher-owned or vendor domain, the binary is unversioned and unverified, and the obfuscation shows intent to conceal the destination.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The testudo-pack npm package version 1.0.0 includes a postinstall script that decodes obfuscated character arrays to reconstruct a URL pointing to a non-vendor domain. It downloads an unpinned, unhashed binary to local system paths (%LOCALAPPDATA% on Windows and ~/.local/share on Linux), sets executable permissions on Linux, and executes the binary detached from the npm process. The same fetch-and-execute routine is also triggered by the pack() API at runtime. The obfuscation and use of an unverified external binary demonstrate intent to conceal malicious activity and evade detection.
Potential Impact
Systems installing or running testudo-pack version 1.0.0 may unknowingly download and execute a malicious binary from an attacker-controlled server. This can lead to unauthorized code execution on affected Windows and Linux hosts. The binary is unpinned and unhashed, increasing risk as its content and behavior are unknown and unverified. macOS systems are not affected by this threat.
Mitigation Recommendations
No official patch or remediation is currently available for testudo-pack version 1.0.0. Users should avoid installing or using this package. Since the malicious behavior is embedded in the package's install script and runtime API, removing the package from projects and dependency trees is recommended. Monitor for any updates or advisories from the package maintainers or npm security team for potential fixes.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-10075
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a50bab068715ace43585917
Added to database: 07/10/2026, 09:26:08 UTC
Last enriched: 07/10/2026, 10:18:04 UTC
Last updated: 07/29/2026, 11:37:25 UTC
Views: 41
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.