npm-publish-testmetest 1.0.1

Details

The package runs node index.js from its postinstall script. The script writes a file named .worm_proof into the operating system's temporary directory, containing the package name and version, the time, the user name and the host name, and prints a message that a worm payload ran. A comment in the code calls it a demo of a self-extracting worm stub. It comes from the same publisher as the worm packages data-pipeline-testmetest and event-emitter-testmetest, and tests the delivery chain of that worm.

Impact: code of an unknown third party runs at install time, and the package is a staging step for a credential-stealing, self-propagating worm.

Remediation: remove the package from all projects and lockfiles, delete .worm_proof from temporary directories, and review the hosts that installed it.