teahy-znrpz-util (npm): malicious package executes zlib-obfuscated payload via Function() on require, skipping CI environments
Severity: critical · Patch status: no-fix-needed · Since 2026-11-11
GitHub Advisory Database (GHSA-53gf-4wh9-g7vw, credited to OpenSSF/amazon-inspector) flags the npm package teahy-znrpz-util version 1.0.0 as malicious code (CWE-506). On module load, index.js reads a numeric byte array hidden under a non-standard bz key in package.json, decompresses it with zlib.inflateSync, and executes the resulting string via the Function constructor with require and dirname bound in. Execution is gated by an early return when CI, GITHUBACTIONS, GITLABCI, TRAVIS, CIRCLECI, or SANDBOX environment variables are set, so the payload only runs on real developer or production hosts with full Node privileges. No patched version exists; the package has no legitimate use. Anyone who installed or required teahy-znrpz-util@1.0.0 outside CI is affected.
What to do
- Remove teahy-znrpz-util@1.0.0 from all dependency trees and lockfiles immediately
- Treat any host where the package was required outside CI as compromised: rotate credentials, tokens, and keys accessible to Node processes
- Audit install/require history and CI logs for the package name and _bz manifest key
- Block the package name in npm registry proxies and internal artifact repositories
- Scan developer and production machines for indicators of the obfuscated-loader pattern (zlib.inflateSync + Function constructor on package.json data)
Sources
All live incidents on Threat Watch
