pixel-map-testmetest 0.0.3

Details

The package ships a hidden binding.gyp, so that installing it makes node-gyp run an obfuscated index.js. That loader decrypts the archive's data.bin with AES-GCM and pipes the result into the Bun JavaScript runtime, which it downloads if needed. The decrypted program is a credential-stealing, self-propagating worm: it looks for cloud credentials, GitHub Actions tokens (GITHUB_TOKEN and the OIDC identity token) and .npmrc files, reads the victim's GitHub repositories and workflows, and uses npm, PyPI and RubyGems publishing credentials to spread. The package poses as an npm staged-publishing stub. Later versions obfuscate the decrypted program further, but it keeps the same worm behavior.

Impact: installing the package on a developer machine or CI job puts every credential reachable there at risk, and can lead to malicious releases published from the victim's accounts.

Remediation: remove the package, treat any machine or CI job that installed it as compromised, rotate all credentials, tokens and publishing keys it could reach, review recent releases and workflow changes in repositories it could access, and run installs with scripts disabled (npm ci --ignore-scripts) where possible.