Vulnerability · MAL-2026-18358
Malicious code in @testsecuiitytestme/cache-helper (npm)
Published Oct 27, 2026 · catalog updated Oct 28, 2026 · Malicious code in @testsecuiitytestme/cache-helper
Last checked Oct 28, 2026. A connected source was read within the last 7 days.
Open the advisory
Exploitation likelihood is not on this record for MAL-2026-18358. A missing EPSS score is not a low risk. Compare Malicious code in @testsecuiitytestme/cache-helper with the linked advisory before you change production.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (Malicious code in @testsecuiitytestme/cache-helper).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- EPSS is missing. A missing score is not a low risk.
- Severity
- Unknown—
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- Awaiting synchronization with FIRST
- Remediation
- Not established
- Affected products
- npm @testsecuiitytestme/cache-helper
@testsecuiitytestme/cache-helper is the only package of the npm account testsecuiitytestme. It was created on 2026-10-27 at 12:08 UTC with npm's staged-publish placeholder 0.0.0-stage, followed by 1.0.1 (12:28 UTC), 1.0.2 (15:33 UTC) and 1.0.3 (16:24 UTC); a 1.0.0 was removed before 14:21 UTC. It describes itself as "Cache helper utilities" and has no README, repository or source code. 1.0.3 was the latest version and still live at the time of this report. Each version runs a native addon at install time. 1.0.1 has postinstall: node -e "try{require(process.platform==='win32'?'./addon_win.node':'./addon.node')}catch(e){}". 1.0.2 and 1.0.3 depend on node-gyp-build and run it as postinstall, which loads the prebuilt addon shipped in prebuilds/linux-x64/node.napi.node or prebuilds/win32-x64/node.napi.node. 1.0.3 adds a binding.gyp with an empty sources list and an install script node-gyp rebuild, so the package looks like an ordinary native module; there is no C source in any version. The addon (Linux ELF and Windows PE) is a loader. It checks for CI and sandbox environments (GITHUB_ACTIONS, GITLAB_CI, TRAVIS, CIRCLECI, JENKINS_URL, BUILDKITE, CODEBUILD_BUILD_ID and others, plus SANDBOX), containers (/proc/1/cgroup: docker, containerd, kubepods, podman), a debugger (TracerPid), memory and CPU count, then reads the sibling file .napi_cache, writes it to a hidden temp file and runs it in a detached process. .napi_cache is JavaScript encoded with a single-byte XOR (0x96). It exits under CI, decodes a second layer (repeating 32-byte XOR, then brotli), locates the Bun runtime or downloads bun 1.2.18 from the official oven-sh/bun GitHub releases, writes the decoded program to the temp directory and runs it detached with Bun. This loader shape matches the second wave of the Shai-Hulud npm worm. The Bun program is obfuscated (javascript-obfuscator string table). Its strings show credential collection for npm, GitHub, GitLab, PyPI, RubyGems, JFrog, Docker Hub and GHCR, AWS, GCP,
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- npm @testsecuiitytestme/cache-helper1.0.1, 1.0.2, 1.0.3
How to fix MAL-2026-18358
No stored fix
No vendor fix text is stored. Use the linked advisory before you change production.
Version check
Seen in 1.0.1 · 2 other packages on the advisory
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
Exploitation likelihood is not on this record for MAL-2026-18358. A missing EPSS score is not a low risk. Compare Malicious code in @testsecuiitytestme/cache-helper with the linked advisory before you change production.
Which versions are affected?
Compare what you have installed with 1.0.1, 1.0.2, 1.0.3. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
No weakness class is stored. EPSS is not on this record yet. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Technology hubs
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 27, 2026 · OpenSSF OSV / OSV Scanner
Detected
@testsecuiitytestme/cache-helper is the only package of the npm account testsecuiitytestme. It was created on 2026-10-27 at 12:08 UTC with npm's staged-publish placeholder 0.0.0-stage, followed by 1.0.1 (12:28 UTC), 1.0.2 (15:33 UTC) and 1.0.3 (16:24 UTC); a 1.0.0 was removed before 14:21 UTC. It describes itself as "Cache helper utilities" and has no README, repository or source code. 1.0.3 was t
Oct 28, 2026 · OpenSSF OSV / OSV Scanner
Updated
@testsecuiitytestme/cache-helper is the only package of the npm account testsecuiitytestme. It was created on 2026-10-27 at 12:08 UTC with npm's staged-publish placeholder 0.0.0-stage, followed by 1.0.1 (12:28 UTC), 1.0.2 (15:33 UTC) and 1.0.3 (16:24 UTC); a 1.0.0 was removed before 14:21 UTC. It describes itself as "Cache helper utilities" and has no README, repository or source code. 1.0.3 was t
Sources
- OpenSSF OSV / OSV ScannerPackage advisoryMAL-2026-18358
Malicious code in @testsecuiitytestme/cache-helper (npm)
osv.dev
Freshness
Last verified in this catalog Oct 28, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- OpenSSF OSV / OSV ScannerOct 28, 2026