Malicious code in testingsmthb1g (npm)
The npm package testingsmthb1g contains malicious code in its postinstall script that acts as an install-time dropper, downloading and executing a Windows binary payload and exfiltrating platform information. The attack includes sandbox escape capabilities for WSL/virtualized Linux environments.
- Disclosed
- Last updated
- Blast radius
- Any developer or system installing the testingsmthb1g npm package on Windows or WSL/Linux environments
- Ecosystems
- Attack vectors
- Affected entities
- testingsmthb1gnpm package containing malicious postinstall script
The npm package testingsmthb1g was found to contain malicious code in its scripts/postinstall.js file that executes during npm installation. The script uses XOR obfuscation (key 'stf2026') to decode a URL pointing to a personal GitHub account unrelated to the package publisher: https://github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe.
On Windows systems, the script downloads the binary to the TEMP directory and executes it detached with stdio suppressed. On WSL or virtualized Linux environments, the script detects the environment via /proc/version and WSL_DISTRO_NAME, constructs an XOR-decoded PowerShell command, and executes it via exec() to fetch and run the same payload on the Windows host, effectively escaping the Linux sandbox.
In parallel, the malicious script POSTs a platform label to a hardcoded bare-IP endpoint http://193.70.34.101:20099/vote for telemetry/tracking purposes. All malicious components—the destination URL, PowerShell command, and shell fragments—are obfuscated as XOR-encoded integer arrays reconstructed at runtime to evade static analysis.
This incident was identified and credited to the OpenSSF's malicious-packages repository (MAL-2026-14142).
Indicators of compromise
- Packages
- testingsmthb1g
- IPs
- 193.70.34.101
Remediation
- Immediately uninstall the testingsmthb1g package from all systems: npm uninstall testingsmthb1g
- Audit npm install logs and package-lock.json to identify when and where testingsmthb1g was installed
- On Windows systems, check TEMP directory for suspicious executables and scan for any downloaded payloads (main.exe)
- Review process execution logs for unexpected PowerShell or binary execution following npm install
- Block outbound connections to 193.70.34.101:20099 at the network level
- Verify the integrity of the npm registry entry and report the malicious package to npm security
- Consider using npm audit and supply chain security tools to detect similar malicious packages
Sources
- GitHub Advisory GHSA-v8gg-g2gm-qxc4 · GitHub Advisory Database
Cite this entry
"Malicious code in testingsmthb1g (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-testingsmthb1g-npm-1luyoa
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in 3-buildsight-web (npm)
The npm package 3-buildsight-web contains malicious code that fetches and executes arbitrary JavaScript from a remote Bitbucket URL on module load, granting full page privileges to an unverified third party.
npmCompromised package - resolvedcritical
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in @syncraft-labs/vue (npm)
The npm package @syncraft-labs/vue version 0.4.1 contained malicious obfuscated code in its ESM build that implements a blockchain-hosted C2 dropper (EtherHiding pattern), enabling remote code execution on any consumer importing the package.
npmCompromised package