MAL-2026-10397

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (326f8f463729022112e04c36fd7a67e785ad8fc37f8e7eec19f60738597bd43d) @car_loans/dealerships-approval 7.1.5 self-describes as a 'browserslist config' but ships a heavily obfuscated postinstall dropper. package.json declares "postinstall": "node scripts/postinstall.js"; that script uses a rotating string-array + RC4 decoder plus byte-array-to-String.fromCharCode wrappers to hide every module name, method, and URL fragment. On `npm install`, the script HTTPS-GETs a remote payload assembled from base64 fragments, RC4-decrypts the response, writes it to disk, chmods 0o755, and spawns it detached with `stdio:'ignore'` and `unref()` — attacker-controlled code executed on the installer's machine with no user interaction. Before and after payload execution, it collects `os.hostname()`, `os.userInfo().username`, platform, arch, package name/version, and an event tag and POSTs them to a base64-assembled remote host; it also encodes fingerprint data into `<hex>.<rand>.<host>` subdomain labels and calls `dns.resolve4` as a DNS-tunnel side channel intended to bypass HTTP egress filtering. The package additionally exhibits the classic dependency-confusion shape: an unusual underscore scope `@car_loans/*`, README that labels it an 'Internal package — Platform Engineering Team', and homepage/repository/registry URLs on the non-existent `car-loans.io` domain instructing consumers to point `.npmrc` at `https://npm.car-loans.io`. Any developer at a targeted organization who resolves this name from the public registry receives immediate install-time code execution and host fingerprint exfiltration.