Malicious npm package event-bus-lite-testmetest — obfuscated installer decrypts and runs hidden Bun payload
Severity: critical · Patch status: no-fix-needed
The npm package event-bus-lite-testmetest@0.0.6 is malicious code, flagged by Amazon Inspector and OpenSSF. Its binding.gyp uses a GYP <!(...) command expansion to run node index.js during the automatic node-gyp rebuild triggered by npm install. index.js is multi-layer obfuscated (Caesar-shifted char-code array passed to eval), reads a bundled ~312 KB high-entropy libnative.dat, brotli-decompresses and AES-128-GCM-decrypts it with hardcoded key/IV/AAD, writes the plaintext to a mkdtempSync('.b-') temp directory, and spawns the Bun runtime to execute the decrypted payload — bypassing Node-only analysis. The payload's contents are not inspectable from the shipped artifact. Only version 0.0.6 is affected; no fixed version exists and the package should be treated as compromised. Anyone who installed it should assume arbitrary code execution on their machine.
What to do
- Remove event-bus-lite-testmetest@0.0.6 from all dependencies and lockfiles
- Audit install logs and CI for installs of this package; rebuild affected machines/containers from trusted images
- Rotate credentials, tokens, and secrets accessible from affected environments
- Check for temp directories matching '.b-*' and any spawned Bun processes as indicators of compromise
- Block the package name in npm/registry allowlists and add the payload sha256 e1ab1e330d3db532d511d4af4386ab2d2c6245ca807410f51c1211ae48814d73 to detection
Sources
All live incidents on Threat Watch
