MalwarePublished 11 Jun 2026Updated 15 Jul 2026

testzapier (npm) · Malicious Code

Affects testzapierSource GCVE Database

Malicious package : remove testzapier and rotate any secrets on hosts that installed it.

Data as of 15 Jul 2026, 12:54 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-5575

What to do

Remove testzapier from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmtestzapier	Affected =1.0.1 =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'testzapier' versions 1.0.0 and 1.0.1 contains malicious code that executes automatically during installation. This code sends sensitive host information, including usernames, hostnames, and contents of critical system files such as /etc/passwd, /etc/hosts, and /etc/shadow (if accessible), to an attacker-controlled server. Installation of this package results in unconditional leakage of sensitive data and likely full system compromise.

Impact

Installation of the 'testzapier' package results in immediate and unconditional leakage of sensitive system information to an attacker-controlled server. This includes user and host identity and contents of critical system files, potentially including password hashes if accessible. The compromise may allow attackers to gain full control over the affected system. Secrets and keys stored on the compromised machine should be considered exposed and rotated immediately. Removal of the package does not guarantee elimination of all malicious artifacts or backdoors.

Defensive guidance

The package should be removed immediately from any affected systems. All secrets, credentials, and keys stored on compromised machines must be rotated from a secure, unaffected environment. Consider the affected systems fully compromised and perform a thorough incident response and forensic analysis. Avoid installing untrusted or suspicious npm packages and verify package authenticity before installation.

Summary

The 'testzapier' npm package (versions 1.0.0 and 1.0.1) includes a preinstall hook that runs 'node index.js' during 'npm install'. This script spawns a shell that performs an HTTP POST request to a malicious external server, embedding the installer's username and hostname in the URL path. The User-Agent header contains a base64-encoded payload with the contents of sensitive files such as /etc/passwd, /etc/hosts, /etc/shadow (if readable), and the output of the 'id' command. This behavior leaks critical system information to an attacker-controlled domain unrelated to the package's intended functionality. The compromise is severe, as any system installing this package is considered fully compromised, with potential exposure of secrets and keys.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 15 Jul 2026, 12:54 UTC

Technical details

References

Community reviews