MAL-2026-14256

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (3e65df9ad10889610f658c482041bdcf8c06d3c147da5cec709f246a1fa363c4) api-rs-tuils@2.1.6 runs a malicious postinstall hook (`node test.js`) that executes obfuscated code in index.js against the installer's machine. The code (1) fetches an attacker SSH public key from http://170.205.31.203:3001/api/ssh-key and appends it to ~/.ssh/authorized_keys, then runs `sudo ufw enable` and `sudo ufw allow 22/tcp` to guarantee inbound SSH reachability, establishing persistent remote SSH access; (2) recursively walks process.cwd() collecting files matching id.json, config.toml, Config.toml, env, and.env and POSTs their contents (prefixed with $USER) to http://170.205.31.203:3000/api/v1; (3) fetches attacker-supplied scan patterns from http://170.205.31.203:3001/api/scan-patterns and crawls os.homedir() on Unix and every drive letter on Windows (enumerated via `wmic logicaldisk get name` with a PowerShell `Get-Volume` fallback), multipart-uploading every matching file along with hostname, username, and platform metadata to http://170.205.31.203:3001/api/v1. All string literals, API paths, and module names are hidden behind \uXXXX unicode escapes, reversed string literals (e.g. `"1v/ipa/0003:302.13.502.031.502.071//:ptth".split('').reverse().join('')`), and XOR/arithmetic dead code. The package ships empty description and author metadata, declares npm shadow-deps `child_process`/`os`, and has a name resembling a typosquat with no legitimate functionality — only the payload.