Malicious Code Vulnerability in log-rotate-testmetest Package
Summary
MAL-2026-18185: Malicious code in log-rotate-testmetest (npm). Affects log-rotate-testmetest versions 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The log-rotate-testmetest package is an npm module designed for testing log rotation functionality. It is intended for developers who need to ensure that their logging mechanisms can handle log file rotations effectively. However, this package has been found to contain malicious code that poses significant security risks to users who install it.
Vulnerability Detail
This vulnerability originates from the package's binding.gyp file, which uses GYP command-expansion to execute a potentially harmful index.js file during installation. The index.js file is obfuscated and contains an eval blob that, when decoded, decrypts a hardcoded ciphertext and executes it. This payload is designed to run under an alternate runtime (Bun) instead of Node.js, making it difficult to detect and analyze. The implications of this vulnerability include unauthorized code execution, potential data breaches, and compromise of the user's environment.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall log-rotate-testmetestIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the log-rotate-testmetest package from your project until a secure version is released. You can uninstall it using the following command: npm uninstall log-rotate-testmetest.
Conclusion
The log-rotate-testmetest package contains a serious vulnerability due to embedded malicious code that executes during installation. Users are advised to update the package to a secure version or remove it entirely until a fix is available. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for log-rotate-testmetest →
FAQ
The malicious code is embedded in an obfuscated eval blob that executes harmful actions upon installation.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
The risks include unauthorized code execution, potential data breaches, and compromise of the user's environment.
Yes, you can temporarily uninstall the package or avoid using it until a secure version is released.
The vulnerability was identified by Amazon Inspector, a service that helps identify security issues in applications.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
