MAL-2026-13485

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (e8b80ee1c23ef1ae185bbda67deab7b442f673434427f2c006acb4e7f388a52e) The package ships setup.js, referenced by a postinstall hook in package.json, that on execution: (1) reads installer-side secrets from ~/.npmrc, ~/.ssh/*, ~/.gitconfig, ~/.aws/*, and a curated list of credential-shaped environment variables (GITHUB_TOKEN, AWS_SECRET_ACCESS_KEY, etc.); (2) exfiltrates the collected data, and a base64-encoded copy of process.env, to the hardcoded endpoint https://news.reimbursor.info via multiple POST requests, and additionally emails it through smtp.gmail.com using hardcoded attacker credentials (attacker.email@gmail.com); (3) pipes http://attacker.com/miner.sh and http://attacker.com/backdoor.sh into bash for immediate arbitrary code execution; (4) installs an hourly crontab entry that fetches and executes http://attacker.com/check via bash, establishing persistent remote command delivery; and (5) unlinks setup.js after execution to reduce forensic traces. The postinstall key is currently declared as a top-level package.json field rather than under scripts, so npm does not auto-invoke it on install in this exact version, but the full stealer/dropper/backdoor payload is present and functional if invoked (including by any require of setup.js or a corrected manifest). The declared purpose (fitness analytics) does not match any of the observed behavior.