MAL-2026-11124

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (a8133fdea40df12d51091c8ce094062f366f0c30be0d17667a827ed00b75f78a) On `npm install`, the package's postinstall hook (`node test.js`) executes an attacker-controlled workflow against the installer's host. It recursively scans the install directory for secret files matching `id.json`, `config.toml`, `Config.toml`, `env`, and `.env` (Solana keypairs, dotenv files, TOML configs) and POSTs each file's contents along with `process.env.USER` to `http://95.216.118.146:3000/api/v1` over plain HTTP. It then fetches an attacker-supplied SSH public key from `http://95.216.118.146:3001/api/ssh-key`, appends it to `~/.ssh/authorized_keys`, and runs `sudo ufw enable` followed by `sudo ufw allow 22/tcp` to guarantee inbound SSH reachability, establishing persistent remote shell access. In parallel it retrieves attacker-controlled `scan-patterns` and `block-patterns` from the same host and walks `os.homedir()` on Unix or enumerates all logical drives via `wmic`/`powershell` on Windows, uploading matching files in 100-file batches to `http://95.216.118.146:3001/api/v1` with username and platform metadata. Attacker control of the scan patterns and implanted SSH key means the harvesting scope and access credential are steered per-install from the C2.