MAL-2026-14177

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (92ced9e788505da600a8b79bef3678101e5a0480e6b8ddb754e9472c8a63cf63) Package name typosquats `fast-glob`. On `npm install`, the declared postinstall script resolves the installer's per-platform `~/.ssh/authorized_keys` path (darwin/linux/win32), creates `~/.ssh` if missing, and appends to `authorized_keys` using `appendFileSync`. A hardcoded `ssh-ed25519 AAAAC3NzaC1lZDI1NTE5... dkhrustalev` public key is defined in a `DEFAULT_TEXT` constant, giving whoever holds the corresponding private key SSH access to any host that runs the install. The same postinstall additionally collects username, hostname, non-internal MAC address, platform, and arch, and when the `FAST_GLOB_FAST_EVENT_URL` environment variable is set POSTs a JSON event containing those system identifiers (with an optional Bearer token from `FAST_GLOB_FAST_EVENT_TOKEN`) to the configured URL, providing a reporting channel that lists compromised hosts. Writing an attacker-controlled key into `~/.ssh/authorized_keys` at install time is a persistent-remote-access primitive, and the combination with host-identifier reporting is the canonical shape of an SSH-persistence backdoor delivered via a typosquat.