{
 "affected": [
  {
   "package": {
    "ecosystem": "npm",
    "name": "retry-utils-testmetest"
   },
   "versions": [
    "1.0.3"
   ]
  }
 ],
 "aliases": [],
 "credits": [
  {
   "contact": [
    "https://protet.io/intel/npm/retry-utils-testmetest/1.0.3"
   ],
   "name": "Protet",
   "type": "FINDER"
  }
 ],
 "details": "Installing retry-utils-testmetest 1.0.3 runs node-gyp on the package's binding.gyp, whose action executes node index.js. The script downloads Bun 1.2.18 (bun-linux-x64-baseline.zip) from the oven-sh/bun GitHub releases into a temporary directory and uses it to run an obfuscated JavaScript payload. The payload reads the host name, runs gh auth token to obtain the GitHub CLI token, checks for ssh and scp, and sets up persistence: it copies sync.py to ~/.local/share/runtimes/sync.py and registers the systemd user service pkg-runtime.service. The same payload ships in event-bus-lite-testmetest 0.0.6 from the same publisher. Impact: theft of GitHub credentials and persistence on developer and CI machines. Remediation: remove the package, revoke and rotate GitHub tokens reachable from the machine, stop and delete ~/.config/systemd/user/pkg-runtime.service and delete ~/.local/share/runtimes/sync.py.",
 "id": "PROTET-NPM-2026-29",
 "modified": "2026-10-22T19:49:01Z",
 "published": "2026-10-22T19:49:01Z",
 "references": [
  {
   "type": "REPORT",
   "url": "https://protet.io/intel/npm/retry-utils-testmetest/1.0.3"
  }
 ],
 "schema_version": "1.6.0",
 "summary": "Install hook downloads Bun, runs a payload that reads the GitHub CLI token and installs a systemd user service"
}