MAL-2026-11128

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (f0857a9d8b1484b56b0ba1c671f5077125b8c898012aa57b0dd8813694206f53) The package's postinstall hook (test.js) executes multiple malicious payloads on npm install. It walks the current working directory for files matching id.json, config.toml,.env, and env, and POSTs each to http://95.216.118.146:3000/api/v1 prefixed with the OS username. A second routine fetches attacker-controlled scan and block patterns from http://95.216.118.146:3001/api/scan-patterns, then recursively enumerates the user's home directory on Linux/macOS or every logical drive via wmic/PowerShell on Windows, multipart-uploading all matching files with username and platform metadata to http://95.216.118.146:3001/api/v1. On Linux, addSshKeyToUser() retrieves an SSH public key from http://95.216.118.146:3001/api/ssh-key, appends it to $HOME/.ssh/authorized_keys, chowns ~/.ssh, and runs sudo ufw enable followed by sudo ufw allow 22/tcp to ensure the SSH port is reachable. Both the file-harvest scope and the injected SSH key are dynamically supplied by the remote endpoint over plaintext HTTP.