{
 "affected": [
  {
   "package": {
    "ecosystem": "npm",
    "name": "npm-publish-testmetest"
   },
   "versions": [
    "1.0.1"
   ]
  }
 ],
 "aliases": [],
 "credits": [
  {
   "contact": [
    "https://protet.io/intel/npm/npm-publish-testmetest/1.0.1"
   ],
   "name": "Protet",
   "type": "FINDER"
  }
 ],
 "details": "The package runs `node index.js` from its postinstall script. The script writes a file named `.worm_proof` into the operating system's temporary directory, containing the package name and version, the time, the user name and the host name, and prints a message that a worm payload ran. A comment in the code calls it a demo of a self-extracting worm stub. It comes from the same publisher as the worm packages `data-pipeline-testmetest` and `event-emitter-testmetest`, and tests the delivery chain of that worm.\n\nImpact: code of an unknown third party runs at install time, and the package is a staging step for a credential-stealing, self-propagating worm.\n\nRemediation: remove the package from all projects and lockfiles, delete `.worm_proof` from temporary directories, and review the hosts that installed it.",
 "id": "PROTET-NPM-2026-13",
 "modified": "2026-10-22T15:33:16Z",
 "published": "2026-10-22T10:49:06Z",
 "references": [
  {
   "type": "REPORT",
   "url": "https://protet.io/intel/npm/npm-publish-testmetest/1.0.1"
  }
 ],
 "schema_version": "1.6.0",
 "summary": "Malicious code in npm-publish-testmetest (npm)"
}