Is npm-publish-testmetest malicious?
Yes. Protet confirmed 1 version of npm-publish-testmetest as malicious
First confirmed on 2026-10-22.
Affected versions
| Version | Confirmed | Protet record |
|---|---|---|
| 1.0.1 | 2026-10-22 | PROTET-NPM-2026-13 |
What it does
The package runs node index.js from its postinstall script. The script writes a file named .worm_proof into the operating system's temporary directory, containing the package name and version, the time, the user name and the host name, and prints a message that a worm payload ran. A comment in the code calls it a demo of a self-extracting worm stub. It comes from the same publisher as the worm packages data-pipeline-testmetest and event-emitter-testmetest, and tests the delivery chain of that worm.
Impact: code of an unknown third party runs at install time, and the package is a staging step for a credential-stealing, self-propagating worm.
Remediation: remove the package from all projects and lockfiles, delete .worm_proof from temporary directories, and review the hosts that installed it.
Indicators
Paths.worm_proof
What to do if you installed it
- Remove the package from every project that uses it, directly or through another dependency.
- Pin a clean version if you need the package: one that is not listed above and that you have checked yourself, or replace the package. A version missing from this page is not cleared.
- Check your lockfiles (
package-lock.json,yarn.lock,pnpm-lock.yaml) for the affected versions, including as a transitive dependency, and in CI caches. - Rotate credentials that were reachable from any machine or build that installed it: npm and GitHub tokens, cloud keys, SSH keys, and secrets in environment variables or CI settings.
Status history
- 2026-10-22: 1.0.1 named by Protet Intel