Which versions of testosu8887 are malicious?

The following npm versions of testosu8887 are flagged malicious: 1.0.1. Treat any of these as compromised.

How do I remediate testosu8887 if I installed it?

testosu8887 is a typosquat — you almost certainly intended a legitimately-named package. Remove testosu8887, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.

I already installed testosu8887 — how do I know if it already compromised me?

If testosu8887 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is testosu8887 part of a known attack campaign?

Yes — testosu8887 is associated with the IN-MAL-2026-020690 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find testosu8887 across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for testosu8887 (version 1.0.1).

Malicious package

testosu8887npm

Advisory published Sep 29, 2026Updated Sep 29, 2026

testosu8887 is a confirmed malicious npm package (MAL-2026-17299) that typosquats a legitimate package to trick installs (malicious version 1.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in testosu8887 (npm)

MAL-2026-17299

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall testosu8887

What this malware does

On require or CLI invocation, dist/index.cjs and dist/cli.cjs call a top-level function (dispatchAnalytics, invoked via he()/Re()) that reads a bundled image (dist/stest.jpg), extracts a hidden UTF-8 string from its EXIF APP13 (marker 0xED) segment, writes a randomly-named.vbs file to the OS temp directory, and spawns wscript.exe detached with windowsHide:true to run it. The VBS launches powershell.exe with an -EncodedCommand argument sourced from the image; the decoded PowerShell downloads https://m1.ppy.sh/r/osu!install.exe to %LOCALAPPDATA%\Temp\lahost.exe and executes it via Start-Process. Sensitive tokens are assembled at runtime from array joins (["power","shell",".exe"].join(""), ["wscript",".exe"].join(""), split -NoProfile/-NonInteractive/-EncodedCommand fragments) and the payload body is hidden in JPEG EXIF rather than present as source strings, concealing the behavior from static scanners. The package name suggests a test/typosquat targeting the osu! game community.

Malicious versions

1 flagged

1.0.1

Indicators of compromise (SHA-256)

7d9d3296b770afd3fdebaf4df9d113873e9c77d2d498d2e7941a3465eeb6f97d

Detection & response playbook

Typosquat

Find it
Search your lockfiles and build artifacts for testosu8887 (version 1.0.1).
If you installed it — respond
testosu8887 is a typosquat — you almost certainly intended a legitimately-named package. Remove testosu8887, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If testosu8887 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. testosu8887 on npm has been identified as a malicious package (version 1.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-020690

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks testosu8887-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database