Which versions of @testsecuiitytestme/cache-helper are malicious?

The following npm versions of @testsecuiitytestme/cache-helper are flagged malicious: 1.0.1, 1.0.2, 1.0.3. Treat any of these as compromised.

How do I remediate @testsecuiitytestme/cache-helper if I installed it?

@testsecuiitytestme/cache-helper is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed @testsecuiitytestme/cache-helper — how do I know if it already compromised me?

If @testsecuiitytestme/cache-helper was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

How do I find @testsecuiitytestme/cache-helper across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for @testsecuiitytestme/cache-helper (3 malicious versions).

Malicious package

@testsecuiitytestme/cache-helpernpm

Advisory published Oct 27, 2026Updated Oct 28, 2026

@testsecuiitytestme/cache-helper is a confirmed malicious npm package (MAL-2026-18358) that steals credentials and exfiltrates sensitive data (malicious versions 1.0.1, 1.0.2, 1.0.3). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in @testsecuiitytestme/cache-helper (npm)

MAL-2026-18358

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall @testsecuiitytestme/cache-helper

What this malware does

@testsecuiitytestme/cache-helper is the only package of the npm account testsecuiitytestme. It was created on 2026-10-27 at 12:08 UTC with npm's staged-publish placeholder 0.0.0-stage, followed by 1.0.1 (12:28 UTC), 1.0.2 (15:33 UTC) and 1.0.3 (16:24 UTC); a 1.0.0 was removed before 14:21 UTC. It describes itself as "Cache helper utilities" and has no README, repository or source code. 1.0.3 was the latest version and still live at the time of this report.

Each version runs a native addon at install time. 1.0.1 has postinstall: node -e "try{require(process.platform==='win32'?'./addon_win.node':'./addon.node')}catch(e){}". 1.0.2 and 1.0.3 depend on node-gyp-build and run it as postinstall, which loads the prebuilt addon shipped in prebuilds/linux-x64/node.napi.node or prebuilds/win32-x64/node.napi.node. 1.0.3 adds a binding.gyp with an empty sources list and an install script node-gyp rebuild, so the package looks like an ordinary native module; there is no C source in any version.

The addon (Linux ELF and Windows PE) is a loader. It checks for CI and sandbox environments (GITHUB_ACTIONS, GITLAB_CI, TRAVIS, CIRCLECI, JENKINS_URL, BUILDKITE, CODEBUILD_BUILD_ID and others, plus SANDBOX), containers (/proc/1/cgroup: docker, containerd, kubepods, podman), a debugger (TracerPid), memory and CPU count, then reads the sibling file .napi_cache, writes it to a hidden temp file and runs it in a detached process.

.napi_cache is JavaScript encoded with a single-byte XOR (0x96). It exits under CI, decodes a second layer (repeating 32-byte XOR, then brotli), locates the Bun runtime or downloads bun 1.2.18 from the official oven-sh/bun GitHub releases, writes the decoded program to the temp directory and runs it detached with Bun. This loader shape matches the second wave of the Shai-Hulud npm worm.

The Bun program is obfuscated (javascript-obfuscator string table). Its strings show credential collection for npm, GitHub, GitLab, PyPI, RubyGems, JFrog, Docker Hub and GHCR, AWS, GCP, Azure, HashiCorp Vault and Kubernetes, plus .ssh, .git-credentials, .env files, browser login databases, the macOS keychain, 1Password and Bitwarden. They also show propagation: npm publishing with provenance, PyPI and RubyGems publishing, GitHub workflow and composite-action injection, GitLab CI template changes, and writes to AI assistant configuration (.claude/settings.json hooks, .cursor rules, .mcp.json, copilot-instructions.md, CLAUDE.md). The exfiltration endpoints sit behind a further string-encoding layer that was not decoded. Analysis was static only; nothing was executed.

Tarball sha256: 1.0.1: a9c98033ac14fced8376bb8ba32bd92426b3729e16f5cd3852c5a97fc3503002 1.0.2: 067a1350278fd1ae4fcc261eaca98964dd23a3c7940988ec43f95758480cf113 1.0.3: 0e99f9a2eb7abcfe65278ca87a8e11dce25f39de2ff4bd77035e2bf01d26f0ed

File sha256: 1.0.2 prebuilds/linux-x64/node.napi.node: 2547686f86fe6994bcf79558fcce441edc67aa734e255acf79870d5f47de7bbf 1.0.2 prebuilds/win32-x64/node.napi.node: 620d2489e18b5a5f8840e96b90673d72db4c4c54d555ad66d179b3a5833e7763 1.0.2 .napi_cache: 463dda65ebceeca6f5590dcdeae6c1d06ffadb2380a85b613deb2923af5557e7 1.0.3 prebuilds/linux-x64/node.napi.node: 1fdd50b1bf66c4fd0e94f2be3db1f2f0fd77921136867022ad7e65e21220ad03 1.0.3 prebuilds/win32-x64/node.napi.node: 5b7a0f53f2eca2dd4bf21e6df7d34e751b6cdf70b2f0a6f1f13edfb5caa9570b 1.0.3 .napi_cache: c14dae9325f451c524cf858ecdae5fa68d2c645ee0981c6f42ef913c7ef34a57

Malicious versions

3 flagged

1.0.11.0.21.0.3

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for @testsecuiitytestme/cache-helper (3 malicious versions).
If you installed it — respond
@testsecuiitytestme/cache-helper is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If @testsecuiitytestme/cache-helper was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. @testsecuiitytestme/cache-helper on npm has been identified as a malicious package (versions 1.0.1, 1.0.2, 1.0.3 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Credits

r-bedekar · analyst

Detect & block this

O3 blocks @testsecuiitytestme/cache-helper-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database