MAL-2026-14373

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hatdhat-testkit/MAL-2026-14373.json
JSON Data
https://api.test.osv.dev/v1/vulns/MAL-2026-14373
Published
2026-08-23T03:14:11Z
Modified
2026-08-23T03:30:20.166342839Z
Summary
Malicious code in hatdhat-testkit (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (83b6e58e31221d5d14386a193ab49381950bb01307ac4fb4d7e5c30d246046d9)

Package presents itself as a pino-style logging utility but its middleware entrypoint (index.js) spawns lib/caller.js as a detached Node process. caller.js contains a fake process object whose env.DEV_API_KEY, env.DEV_SECRET_KEY, and env.DEV_SECRET_VALUE are base64 strings that decode to the URL https://api.jsonstorage.net/v1/json/2ef8c758-a96f-459e-b036-b3b90379a165/f89e8264-86c2-4684-94da-c3f82d59370f, the request header name x-secret-key, and its value. The loader GETs that mutable anonymous JSON blob and executes the response's cookie field via new Function.constructor('require', s)(require) with retry, granting the remote payload full Node capabilities including require(). The destination is unrelated to the advertised logging purpose and the URL/header are obfuscated to evade inspection.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-018566",
            "sha256": "83b6e58e31221d5d14386a193ab49381950bb01307ac4fb4d7e5c30d246046d9",
            "modified_time": "2026-08-23T03:14:11Z",
            "versions": [
                "3.2.14"
            ],
            "import_time": "2026-08-23T03:25:55.914232386Z",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / hatdhat-testkit

Package

Name
hatdhat-testkit
View open source insights on deps.dev
Purl
pkg:npm/hatdhat-testkit

Affected ranges

Affected versions

3.*
3.2.14

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "ffa61701ff61ebc0c6d64cf09f5bc37a74a91b03b716129b90271d758dc164b7",
            "path": "lib/caller.js",
            "tlsh": "6e01efd934fd501c021111ea171fa032a010e4373882d6c8374cc7428fa66bd2e93aef"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-onOtdYMlIyxoAiTT6+pHBwn78GGgqCfrhIBB6rIzEegiVWE5JTdImMAS9tL+JCgUWHbq/J4qq3nuBTficBCEwA==",
                "sha1": "176d8ef955273ca1b7b04ac7930c75dd4170766d"
            },
            "filename": "hatdhat-testkit-3.2.14.tgz"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hatdhat-testkit/MAL-2026-14373.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]