Is retry-utils-testmetest malicious?
Yes. Protet confirmed 1 version of retry-utils-testmetest as malicious
First confirmed on 2026-10-22.
Affected versions
| Version | Confirmed | Protet record |
|---|---|---|
| 1.0.3 | 2026-10-22 | PROTET-NPM-2026-29 |
What it does
Install hook downloads Bun, runs a payload that reads the GitHub CLI token and installs a systemd user service
Installing retry-utils-testmetest 1.0.3 runs node-gyp on the package's binding.gyp, whose action executes node index.js. The script downloads Bun 1.2.18 (bun-linux-x64-baseline.zip) from the oven-sh/bun GitHub releases into a temporary directory and uses it to run an obfuscated JavaScript payload. The payload reads the host name, runs gh auth token to obtain the GitHub CLI token, checks for ssh and scp, and sets up persistence: it copies sync.py to ~/.local/share/runtimes/sync.py and registers the systemd user service pkg-runtime.service. The same payload ships in event-bus-lite-testmetest 0.0.6 from the same publisher. Impact: theft of GitHub credentials and persistence on developer and CI machines. Remediation: remove the package, revoke and rotate GitHub tokens reachable from the machine, stop and delete ~/.config/systemd/user/pkg-runtime.service and delete ~/.local/share/runtimes/sync.py.
What to do if you installed it
- Remove the package from every project that uses it, directly or through another dependency.
- Pin a clean version if you need the package: one that is not listed above and that you have checked yourself, or replace the package. A version missing from this page is not cleared.
- Check your lockfiles (
package-lock.json,yarn.lock,pnpm-lock.yaml) for the affected versions, including as a transitive dependency, and in CI caches. - Rotate credentials that were reachable from any machine or build that installed it: npm and GitHub tokens, cloud keys, SSH keys, and secrets in environment variables or CI settings.
Status history
- 2026-10-22: 1.0.3 named by Protet Intel