Protet Intel / npm / @testsecuiitytestme/cache-helper
@testsecuiitytestme/cache-helper 1.0.7
confirmed malicious
PROTET-NPM-2026-175
Every version of this package that Protet Intel names: Is @testsecuiitytestme/cache-helper malicious?
Details
@testsecuiitytestme/cache-helper installs a credential stealer and self-spreading worm. On developer machines its install script loads a prebuilt native addon that decodes and runs a hidden, obfuscated program which collects package-registry, source-hosting, container and cloud credentials, Vault and Kubernetes secrets and SSH keys. Treat any machine that installed it as compromised and rotate all credentials from a different machine. Also listed as MAL-2026-18358.
Records
- OSV record PROTET-NPM-2026-175
- Also reported in OSV as MAL-2026-18358
- Feeds: NDJSON, Atom
Status history
- 2026-11-07: named as a Protet finding