Malicious Code Injection in test-brotli2-testmetest Package
Summary
MAL-2026-18182: Malicious code in test-brotli2-testmetest (npm). Affects test-brotli2-testmetest versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The test-brotli2-testmetest package, version 1.0.0, is an npm package designed for testing purposes. It is a rebuild of the data-pipeline-testmetest 2.0.1 package, which has been identified as a credential stealer. This package executes malicious code during its installation process, posing a significant security risk to users.
Vulnerability Detail
The vulnerability arises from the package's install script, which triggers a node-gyp rebuild. The binding.gyp file employs GYP command-expansion to execute an obfuscated JavaScript file (index.js) that decrypts a Brotli-compressed payload and executes it. This payload is a malicious program that can compromise the user's system by stealing credentials. The malicious code is embedded in the package and runs automatically upon installation, making it particularly dangerous. The vulnerability is classified under CWE-506, indicating that the product contains code that appears to be malicious in nature.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall test-brotli2-testmetestIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid installing the test-brotli2-testmetest package until a secure version is released. Additionally, consider using tools like Vulert to monitor your project for vulnerabilities. You can check if your application is affected by this vulnerability using the Vulert playground at https://vulert.com/scanner without any signup.
Conclusion
The test-brotli2-testmetest package contains a serious vulnerability that executes malicious code during installation. Users are advised to uninstall the package and monitor their applications for vulnerabilities using tools like Vulert. Staying informed and proactive is essential to maintaining software security.
See every vulnerability recorded for test-brotli2-testmetest →
FAQ
It is an npm package intended for testing purposes, but it has been identified as containing malicious code.
The vulnerability manifests during the installation process when the package executes malicious code that can steal credentials.
You should uninstall the package immediately using npm uninstall test-brotli2-testmetest.
Yes, you can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application.
Vulert is a tool that monitors and alerts users in real-time for open-source vulnerabilities in software, using just the package-lock.json file.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
