test-brotli2-testmetest 1.0.0

Details

The package ships a hidden binding.gyp and an install script that runs node-gyp rebuild, so that installing it makes node-gyp run an obfuscated index.js. That loader decrypts an embedded payload with AES-GCM and gzip or brotli and pipes the result into the Bun JavaScript runtime, which it downloads if needed. The decrypted program is a credential-stealing, self-propagating worm: it looks for cloud credentials, GitHub Actions tokens (GITHUB_TOKEN and the OIDC identity token) and .npmrc files, reads the victim's GitHub repositories and workflows, and uses npm, PyPI and RubyGems publishing credentials to spread.

Impact: installing the package on a developer machine or CI job puts every credential reachable there at risk, and can lead to malicious releases published from the victim's accounts.

Remediation: remove the package, treat any machine or CI job that installed it as compromised, rotate all credentials, tokens and publishing keys it could reach, review recent releases and workflow changes in repositories it could access, and run installs with scripts disabled (npm ci --ignore-scripts) where possible.