{
 "affected": [
  {
   "package": {
    "ecosystem": "npm",
    "name": "@testsecuiitytestme/cache-helper"
   },
   "versions": [
    "1.0.7"
   ]
  }
 ],
 "aliases": [
  "MAL-2026-18358"
 ],
 "credits": [
  {
   "contact": [
    "https://protet.io/intel/npm/@testsecuiitytestme/cache-helper/1.0.7"
   ],
   "name": "Protet",
   "type": "FINDER"
  }
 ],
 "details": "@testsecuiitytestme/cache-helper installs a credential stealer and self-spreading worm. On developer machines its install script loads a prebuilt native addon that decodes and runs a hidden, obfuscated program which collects package-registry, source-hosting, container and cloud credentials, Vault and Kubernetes secrets and SSH keys. Treat any machine that installed it as compromised and rotate all credentials from a different machine. Also listed as MAL-2026-18358.",
 "id": "PROTET-NPM-2026-175",
 "modified": "2026-11-07T18:09:01Z",
 "published": "2026-11-07T18:09:01Z",
 "references": [
  {
   "type": "REPORT",
   "url": "https://protet.io/intel/npm/@testsecuiitytestme/cache-helper/1.0.7"
  }
 ],
 "schema_version": "1.6.0",
 "summary": "Malicious code in @testsecuiitytestme/cache-helper (npm)"
}