Malicious code in event-emitter-testmetest (npm)

event-emitter-testmetest was published by npm account testnewtestme2 on 2026-10-21, first to test the delivery chain of data-pipeline-testmetest 2.0.1 and then to ship it. 1.0.6 and 1.0.7 ship an obfuscated index.js loader that decrypts a filler stage and pipes it into Bun with the full...

Malicious code in log-sink-testmetest (npm)

log-sink-testmetest 1.0.1 ships the credential stealer of data-pipeline-testmetest 2.0.1 and runs it on npm install without an install script: its binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, which decrypts data.bin and pipes it into Bun. The payload is identical to...

MAL-2026-18179 Malicious code in log-sink-testmetest (npm)

log-sink-testmetest 1.0.1 ships the credential stealer of data-pipeline-testmetest 2.0.1 and runs it on npm install without an install script: its binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, which decrypts data.bin and pipes it into Bun. The payload is identical to...

MAL-2026-18178 Malicious code in event-emitter-testmetest (npm)

event-emitter-testmetest was published by npm account testnewtestme2 on 2026-10-21, first to test the delivery chain of data-pipeline-testmetest 2.0.1 and then to ship it. 1.0.6 and 1.0.7 ship an obfuscated index.js loader that decrypts a filler stage and pipes it into Bun with the full...

Malicious code in event-emitter-testmetest (npm)

event-emitter-testmetest was published by npm account testnewtestme2 on 2026-10-21, first to test the delivery chain of data-pipeline-testmetest 2.0.1 and then to ship it. 1.0.6 and 1.0.7 ship an obfuscated index.js loader that decrypts a filler stage and pipes it into Bun with the full...

Malicious Package

Overview event-emitter-testmetest is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

MSC-2026-11645

Malicious npm packages impersonating math, event-emitter, mutex, graph and B-tree utility libraries. The payload is embedded in the library's runtime API rather than an install script, so it executes only when a consuming application calls a specific method with attacker-chosen input, then...

Malicious code in cardsmobile-event-emitter (npm)

Source: amazon-inspector 66db77fd91ad9316ea06a13f10281595e60cf846e89787bcbb793d061cdd1315 On require of cardsmobile-event-emitter, index.js unconditionally loads loader.js, which fetches an opaque platform-specific binary over HTTPS from runtime-concatenated Cloudflare Workers hosts...

Malicious code in cardsmobile-event-emitter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66db77fd91ad9316ea06a13f10281595e60cf846e89787bcbb793d061cdd1315 On require of cardsmobile-event-emitter, index.js unconditionally loads loader.js, which fetches an opaque platform-specific binary over HTTPS from...

MAL-2026-12532 Malicious code in cardsmobile-event-emitter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66db77fd91ad9316ea06a13f10281595e60cf846e89787bcbb793d061cdd1315 On require of cardsmobile-event-emitter, index.js unconditionally loads loader.js, which fetches an opaque platform-specific binary over HTTPS from...

MAL-2026-12271 Malicious code in tinkoff-statist-browser-typed-client-sme.platform.mobile.employees.common.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48c11733eb4b38a76b46aec55e66c98300f8fa301d065f27c271b45e0157c6b4 The package is presented as a trivial event emitter but its main entry index.js auto-loads bootstrap.js on require. bootstrap.js selects a per-platfo...

Malware in @antv/event-emitter

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @antv/event-emitter (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-3879 Malicious code in @antv/event-emitter (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in pentest-event-emitter (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-6946 Malicious code in pentest-event-emitter (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

MAL-2022-815 Malicious code in ac-event-emitter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b881c8ae7b1f025424e1588fb707b670163a23639f41dcccd759836882e423d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in ac-event-emitter

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in ac-event-emitter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b881c8ae7b1f025424e1588fb707b670163a23639f41dcccd759836882e423d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Hyperledger: Enrolling to a CA that returns an empty response crashes the node process

If a CA server responds with an empty response during enrollment, an exception is thrown in the event emitter on end. This is an uncaughtException and causes the containing node process to exit. To replicate: With the attached files, run: npm install node badCa.js & node index.js This starts a...