data-pipeline-testmetest 2.0.1 is a self-spreading credential stealer that runs on npm install without an install script: its binding.gyp source <!(env node index.js >/dev/null 2>&1; echo stub.c) makes node-gyp run index.js, an obfuscated loader that decrypts a 939 KB payload and pipes it into Bun (downloaded from GitHub if missing). The payload steals GitHub, npm, PyPI, RubyGems and cloud credentials, commits them to a public repository it creates in the victim's GitHub account (description project-utils), and republishes the victim's packages with the same hook. Published by npm account testnewtestme2 on 2026-10-21.
If it finds a GitHub token it installs a net-health-checker user service that runs rm -rf ~/ once the token is revoked. Remove ~/.local/bin/net-health-checker.sh and its systemd unit or LaunchAgent before revoking the token, then rotate all reachable credentials.
Credit: OpenSSF (source)
References
data-pipeline-testmetest 2.0.1 is a self-spreading credential stealer that runs on
npm installwithout an install script: itsbinding.gypsource<!(env node index.js >/dev/null 2>&1; echo stub.c)makes node-gyp runindex.js, an obfuscated loader that decrypts a 939 KB payload and pipes it into Bun (downloaded from GitHub if missing). The payload steals GitHub, npm, PyPI, RubyGems and cloud credentials, commits them to a public repository it creates in the victim's GitHub account (descriptionproject-utils), and republishes the victim's packages with the same hook. Published by npm accounttestnewtestme2on 2026-10-21.If it finds a GitHub token it installs a
net-health-checkeruser service that runsrm -rf ~/once the token is revoked. Remove~/.local/bin/net-health-checker.shand its systemd unit or LaunchAgent before revoking the token, then rotate all reachable credentials.Credit: OpenSSF (source)
References