@test-org-aczxvz/test-package (npm): malicious init() exfiltrates HMAC keys and bearer tokens to attacker webhook (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-13
GitHub Advisory Database (GHSA-92mx-87xp-ppw9, credited to Amazon Inspector via OpenSSF malicious-packages) flags npm package @test-org-aczxvz/test-package version 1.0.0 as malware. Its public init(options) API serializes the entire options object — including the HMAC signing key passed as loggingdata, bearer token, region, instance, and entropy fields — and POSTs it to a hardcoded collector URL built from options.rngserverurl plus UUID path f4927958-be83-4bb1-9265-eaf4b9e0417d (overridable via RNGCOLLECTORUUID, defaulting to a webhook.site-style bin). The payload is sent both as a JSON body and a base64-encoded ?d= query parameter for redundancy. Any caller invoking init() with real runtime credentials silently leaks them to the attacker before local use. No patched version exists; the package must be removed.
What to do
- Remove @test-org-aczxvz/test-package@1.0.0 from all dependency trees and lockfiles immediately
- Rotate any HMAC signing keys, bearer tokens, and credentials passed to init() on systems where the package ran
- Audit logs and network egress for POSTs to webhook.site-style bins or the UUID path f4927958-be83-4bb1-9265-eaf4b9e0417d
- Scan build and runtime environments for RNG_COLLECTOR_UUID overrides and similar typosquatted @test-org-* packages
- Block egress to webhook.site and similar exfiltration services from CI/CD and build hosts
Sources
All live incidents on Threat Watch
