Malicious Code Execution Vulnerability in testmgkregme Package
Summary
MAL-2026-16317: Malicious code in testmgkregme (npm). Affects testmgkregme versions 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The testmgkregme package is an npm module designed for specific functionalities within JavaScript applications. However, it has been identified to contain a serious vulnerability that allows for malicious code execution during the installation process. This vulnerability arises from the package's use of a binding.gyp file that triggers code execution without proper safeguards, exposing users to potential security risks.
Vulnerability Detail
The vulnerability in the testmgkregme package stems from its binding.gyp file, which employs GYP command-expansion to execute arbitrary JavaScript code during the installation process. Specifically, the command '<!(env node index.js...; echo stub.c)' runs 'node index.js' when 'node-gyp rebuild' is invoked by npm. This results in the execution of a 2.9 MB obfuscated JavaScript file that uses multiple layers of encoding and encryption to conceal its true intent, ultimately executing malicious code on the user's machine with their privileges. The absence of legitimate native source files indicates that the binding.gyp is solely designed to facilitate this malicious behavior.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall testmgkregmeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid installing the testmgkregme package altogether. If it is already installed, you should uninstall it using the command: npm uninstall testmgkregme. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The testmgkregme package contains a significant vulnerability that allows for the execution of malicious code during installation. Users are advised to uninstall the package and monitor for updates. Utilizing tools like Vulert can help in identifying and managing such vulnerabilities in your projects.
See every vulnerability recorded for testmgkregme →
FAQ
The testmgkregme package is an npm module that is intended for use in JavaScript applications, but it has been found to contain malicious code.
The vulnerability allows for arbitrary code execution during the installation of the package, which can lead to malicious actions being performed on the user's machine.
If you have installed the testmgkregme package, you should uninstall it immediately and check for any updates or patches from the package maintainers.
Yes, tools like Vulert can monitor your package-lock.json file for open-source vulnerabilities in real-time, alerting you to any issues.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
