testpackage83 (npm): malicious package downloads and executes remote binary via postinstall and on import
Severity: critical · Patch status: no-fix-needed · Since 2026-11-14
The npm package testpackage83@1.0.0 is confirmed malware (CWE-506). Its postinstall script downloads an executable from http://185.212.128.180/chromedriver.bat, writes it to ~/.celest/bin/chrome (or chrome.exe), marks it executable, and launches it via puppeteer-core. The download-and-execute path is also triggered from src/browser.js on first require()/import, bypassing the CELESTSKIPDOWNLOAD opt-out. The artifact is fetched over plain HTTP from a bare IPv4 address with no hash, signature, or version pinning, so the host operator fully controls the executed code. Anyone installing or importing the package runs attacker-controlled code. No patched version exists; the package should be removed.
What to do
- Remove and uninstall testpackage83 immediately; purge ~/.celest/bin and any downloaded chrome/chrome.exe artifacts
- Audit machines that installed the package for compromise and rotate credentials/secrets accessible to those environments
- Block 185.212.128.180 at network egress and check proxy/DNS logs for connections to it
- Check lockfiles and CI caches for testpackage83@1.0.0 and rebuild from clean environments
- Pin dependencies and enable npm provenance/audit tooling to detect similar download-and-execute postinstall packages
Sources
All live incidents on Threat Watch
