MAL-2026-12002

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (bc4ea1b382140e833e01605ec5278b7a9a877aaaddd96ea9057efef2560b66b2) On import of the package's main entry, a top-level async IIFE in index.mjs (labelled 'ENGINE INITIALIZATION & CALIBRATION') copies the shipped file dist/cache.bin to os.tmpdir()/sm-engine-runtime/math-core.bin and spawns it via child_process.spawn. The dropped ELF is a full Linux implant containing a hardcoded C2 at 217.60.77.63, a SECURE_BEACON|...|REDSHELL beacon protocol, a remote-shell dispatcher invoking /bin/sh and /bin/bash on C2-supplied input, SOCKS5 proxy and TCP port-forwarding, staged payload execution via curl plus memfd/mktemp, and systemd --user persistence via svc-update.service. The implant exposes beacon commands /ssh_keys, /creds, /dbfind, /download, /upload, /dataextract, and /clipboard, and exfiltrates collected data through POST /api/extract-receive on the C2. The package advertises calendar and streak math primitives; the calibration/JIT wording in the surrounding comments is a cover story contradicted by the binary's contents.