MAL-2026-14374

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/rust-testing-utils/MAL-2026-14374.json
JSON Data
https://api.test.osv.dev/v1/vulns/MAL-2026-14374
Published
2026-08-23T03:14:27Z
Modified
2026-08-23T03:30:18.841074532Z
Summary
Malicious code in rust-testing-utils (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ee33bdedc7938508bcb50e053c441770948d3d69a51c5cab5d4280d84ceffa65)

The package impersonates the pino logger in its README, keywords, and API surface. index.js exports middleware that spawns lib/caller.js as a detached child process on invocation. caller.js reconstructs a hardcoded URL by base64-decoding a value stored under a fake process.env.DEV_API_KEY inside a fabricated process object, resolving to https://api.jsonstorage.net/v1/json/2ef8c758-a96f-459e-b036-b3b90379a165/f89e8264-86c2-4684-94da-c3f82d59370f. It fetches this URL with axios and passes the returned cookie field to new Function.constructor("require", s), then invokes the resulting function with require as an argument, giving the remotely fetched code arbitrary execution with full module-loading capability in the consumer's process. The endpoint content is attacker-controlled and mutable, so the executed payload can change at any time without a package update. The base64-encoded URL, fabricated env-var names used to hide the destination, and pino-lookalike cover story are consistent with an intentional supply-chain attack rather than legitimate functionality.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-018568",
            "versions": [
                "2.3.0"
            ],
            "modified_time": "2026-08-23T03:14:27Z",
            "sha256": "ee33bdedc7938508bcb50e053c441770948d3d69a51c5cab5d4280d84ceffa65",
            "import_time": "2026-08-23T03:25:56.10785665Z",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / rust-testing-utils

Package

Name
rust-testing-utils
View open source insights on deps.dev
Purl
pkg:npm/rust-testing-utils

Affected ranges

Affected versions

2.*
2.3.0

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "ffa61701ff61ebc0c6d64cf09f5bc37a74a91b03b716129b90271d758dc164b7",
            "path": "lib/caller.js",
            "tlsh": "6e01efd934fd501c021111ea171fa032a010e4373882d6c8374cc7428fa66bd2e93aef"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-L5vNVHqPOd3eApiQG9P/sylHG3hDx2G/Z6KfXbkQvord6iG2HAu9ECtjmUjqi7PJ4SlLs63DZufkTUQ1q8bqZA==",
                "sha1": "8b1a3da9fa60a8a338c4e95551620a2591d7d310"
            },
            "filename": "rust-testing-utils-2.3.0.tgz"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/rust-testing-utils/MAL-2026-14374.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]