@testsecuiitytestme/cache-helper@1.0.7

Summary

@testsecuiitytestme/cache-helper@1.0.2 ships prebuilt native N-API addons (linux-x64 and win32-x64) alongside a 2,395,377-byte byte-identical opaque sibling file prebuilds/<platform>/.napi_cache (sha256 463dda65ebceeca6f5590dcdeae6c1d06ffadb2380a85b613deb2923af5557e7) that has no printable strings. index.js is a one-liner that loads the native addon via node-gyp-build, so simply require()'ing the package triggers the native code. The addon decrypts the.napi_cache blob, writes it to a temp file (/tmp/.<pid> or %TEMP%\.nc<pid>.js), and spawns a detached node process to execute it (Linux: fork/setsid/execlp/chmod; Windows: CreateProcessA/GetTempPathA/SetFileAttributesA). Before detonation the addon performs environment checks characteristic of a stealth dropper: it enumerates CI environment variables (GITHUB_ACTIONS, GITLAB_CI, CIRCLECI, JENKINS_URL, BUILDKITE, CODEBUILD_BUILD_ID, APPVEYOR, SEMAPHORE, TEAMCITY_VERSION, BITBUCKET_BUILD_NUMBER, NOW_GITHUB_DEPLOYMENT, CF_BUILD_ID, SCREWDRIVER) and, on Linux, probes /proc/1/cgroup, /proc/1/cmdline, /proc/self/status (TracerPid:), /proc/self/maps, and containerd/dockerinit markers; on Windows it imports IsDebuggerPresent, CheckRemoteDebuggerPresent, CreateToolhelp32Snapshot and scans the process list for analysis tools (wireshark, httpdebug). There is no documented API, no public functionality, and no legitimate reason for a cache helper to decrypt an opaque blob and execute it via a fresh node interpreter while suppressing itself on CI and under debuggers. Any installer that requires this package executes attacker-controlled JavaScript on their host.

Source: amazon-inspector (ae1e2c166136deef5f2f928f910041889d6aea8ff097588a013f156220f8f93b)