Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
- Disclosed
- Last updated
- Blast radius
- Any npm consumer of rust-testing-utils package
- Ecosystems
- Attack vectors
- Affected entities
- rust-testing-utilsnpm package
The npm package rust-testing-utils was found to contain intentional malicious code designed to execute arbitrary remote payloads. The package masquerades as the pino logger in its README, keywords, and API surface to evade detection.
When invoked, the package's index.js exports middleware that spawns a detached child process (lib/caller.js). This child process reconstructs a hardcoded URL by base64-decoding a value stored under a fabricated process.env.DEV_API_KEY environment variable, resolving to https://api.jsonstorage.net/v1/json/2ef8c758-a96f-459e-b036-b3b90379a165/f89e8264-86c2-4684-94da-c3f82d59370f.
The malicious code fetches this attacker-controlled endpoint using axios and passes the returned cookie field to new Function.constructor("require", s), then invokes the resulting function with require as an argument. This grants the remotely-fetched code arbitrary execution with full module-loading capability in the consumer's process. The endpoint content is mutable and can be changed at any time without requiring a package update.
The obfuscation techniques—base64-encoded URL, fabricated environment variable names, and pino-lookalike cover story—are consistent with an intentional supply-chain attack rather than legitimate functionality. The incident was identified by the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- rust-testing-utils
- Domains
- api.jsonstorage.net
Remediation
- Remove rust-testing-utils from all dependencies immediately
- Audit all systems that installed this package for signs of compromise or data exfiltration
- Review process logs and network traffic from affected systems for connections to api.jsonstorage.net
- Regenerate any credentials or secrets that may have been exposed to the compromised process
- Update to a safe alternative logger package if pino functionality is required
Sources
- GitHub Advisory GHSA-mgfq-rgcw-ff87 · GitHub Advisory Database
Cite this entry
"Malicious code in rust-testing-utils (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 23, 2026; last updated August 23, 2026. https://supplychainattack.org/incident/malicious-code-in-rust-testing-utils-npm-148pik
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in dxr-dos (npm)
The npm package dxr-dos contains malicious code that executes arbitrary code via a mutable third-party dependency (deathoffather-project) and extracts a hidden PHP C2 panel from a password-protected archive. The package is advertised as a DDoS toolkit with command-and-control capabilities.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in ranux-pro (npm)
The npm package ranux-pro contained malicious code disguised as a network socket library. The package shipped a multi-tenant WhatsApp bot with obfuscated code and a mutable dependency override pointing to a personal GitHub account, allowing attackers to execute arbitrary code at install and runtime.
npmCompromised packageMalicious commit - containedcritical
Malicious code in dxrs-dos (npm)
The npm package dxrs-dos is an openly-advertised DDoS/booter toolkit that executes malicious code on module load. It uses an unpinned dependency (deathoffather-project) for arbitrary code execution and extracts a password-protected PHP C2 panel archive into the caller's working directory.
npmCompromised packageMalicious commit