MAL-2026-10405

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (b8f88862ffacb671bdaed8521274293d5ef20bafee0deb91cc38cd852daa6a7d) @torbeck/heap impersonates the legitimate @datastructures-js/heap package: README.md line 1 reads `# @datastructures-js/heap`, package.json sets homepage/repository/bugs to github.com/datastructures-js/heap and author to `Eyas Ranjous <eyas-ranjous@gmail.com>`, while the npm scope `@torbeck` is unrelated. The package re-exports the genuine Heap class so consumers get a working API. Appended to src/heap.js after `exports.Heap = Heap;` (around line 247) is a heavily obfuscated obfuscator.io payload (two rotated string-array RC4-style decoders, ~580 and ~700 entries, with Function.toString anti-tamper traps and console-method override checks). On `require('@torbeck/heap')` via the package's index.js main entry, the payload derives an AES key by XORing four hardcoded buffers, decrypts a hidden URL, issues an http/https.request to download a binary into os.tmpdir(), writes a PID lock and.meta.json with a sha256, chmods the file to 0755, and spawns it detached via process.execPath or `bash -c` with stdio:'ignore', windowsHide:true, and unref() — plus a re-exec wrapper that respawns the parent under a sentinel. Platform-specific branches handle win/linux/mac. There is no version pinning or signature check on the downloaded bytes, the URL is concealed by obfuscation, and the dropped binary's purpose is unrelated to a heap data-structure library. This is a typosquat carrying an install/require-time RCE dropper.