MAL-2026-19938: Malicious code in testpackage83 (npm)

Published Nov 14, 2026

Updated

--- -= Per source details. Do not edit below this line.=-

Source: amazon-inspector (000cea12be23bd792df9085f773c94b79ee13ae70b5154f7d619847bf1b3f0d7) The package's postinstall script downloads an executable from http://185.212.128.180/chromedriver.bat, writes it to ~/.celest/bin/chrome (or chrome.exe), sets it executable, and later launches it through puppeteer-core. The source is a bare IPv4 address over plain HTTP with no hash, signature, or version pinning, and the URL path is a Windows.bat named 'chromedriver' while the package frames the artifact as a patched Chromium. The same download-and-execute path is also reached from src/browser.js, which calls download() followed by puppeteer.launch({ executablePath }) on first library use, so require()/import of the package will fetch and run the binary even when the postinstall step is skipped via CELESTSKIPDOWNLOAD. The destination host is not associated with any legitimate Chromium publisher, and the operator of that host fully controls the bytes that are executed on the installer's machine.

Affected Software

1 affected component

npm/testpackage83=1.0.0

Event History

Nov 14, 2026

Advisory Published

via OSV·08:23 PM

Data Sourced

via OSV·08:23 PM

DescriptionAffected Software

Frequently Asked Questions

What systems are exposed to execution of the downloaded binary?

Any system that installs the package can be exposed through its postinstall script. Systems that import or require the package can also be exposed on first library use, because src/browser.js downloads and launches the binary through puppeteer-core.

Does setting CELEST_SKIP_DOWNLOAD prevent the malicious download and execution?

No. Although this can skip the postinstall step, the same download-and-launch path is reached when the library is first used after import or require.

What does the package download and where does it place it?

It retrieves an executable over plain HTTP from 185.212.128.180/chromedriver.bat. It writes the file to ~/.celest/bin/chrome or chrome.exe, marks it executable, and launches it.

Why is the downloaded artifact especially risky?

The download has no hash, signature, or version pinning, and it is obtained from a bare IPv4 address over HTTP. The operator of that host can control the bytes executed on the installing machine.

How can I check whether a host may have been affected?

Check for ~/.celest/bin/chrome or chrome.exe and investigate whether it was downloaded from 185.212.128.180/chromedriver.bat. Also review whether testpackage83 version 1.0.0 was installed or used on the host.

MAL-2026-19938: Malicious code in testpackage83 (npm)

Affected Software

Event History

Frequently Asked Questions

What systems are exposed to execution of the downloaded binary?

Does setting CELEST_SKIP_DOWNLOAD prevent the malicious download and execution?

What does the package download and where does it place it?

Why is the downloaded artifact especially risky?

How can I check whether a host may have been affected?

Company

Resources

Contact

Frequently Asked Questions

What systems are exposed to execution of the downloaded binary?

Does setting CELEST_SKIP_DOWNLOAD prevent the malicious download and execution?

What does the package download and where does it place it?

Why is the downloaded artifact especially risky?

How can I check whether a host may have been affected?