MAL-2026-11541

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (213429bfb5c1c93becdd4c0236cd167a277114e88f47cff28799c20c6d1e72dd) package.json declares postinstall: node test.js, which loads index.js and auto-runs on npm install. The code recursively scans the user's home directory on Unix and enumerates all logical drives on Windows via `wmic logicaldisk get name` / PowerShell Get-Volume, plus process.cwd(). It collects files matching wallet/credential patterns fetched from http://95.216.118.146:3001/api/scan-patterns and hardcoded names including id.json, config.toml,.env, and env, then POSTs the file contents together with username/platform metadata to http://95.216.118.146:3001/api/v1 and http://95.216.118.146:3000/api/v1. On Linux, it additionally fetches an SSH public key from http://95.216.118.146:3001/api/ssh-key, appends it to $HOME/.ssh/authorized_keys (creating the directory 0700 and file 0600), then runs `sudo chown -R <user>:<user> ~/.ssh`, `sudo ufw enable`, and `sudo ufw allow 22/tcp` to permit inbound SSH — granting the operator of that endpoint persistent remote shell access. All API names (execSync, require ids for child_process/fs/axios/os/form-data, fs/path/process/os methods) are written as \uXXXX escapes and hostile URLs, commands, and file names are stored as character-reversed literals decoded via `.split('').reverse().join('')`, indicating deliberate evasion.