MAL-2026-13368

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (e127c5f6a6747ae491acb2166ed55c1e6aba47aca1166ade97bf084b5dbbce31) express-dever@5.1.8 registers `postinstall: node index.js` in package.json, and index.js is heavily obfuscated (obfuscator.io-style rotated string array with RC4/base64 decoders, hex-numeric constant folding, `_0x` variable naming, control-flow flattening). Decoded, the script requires axios/fs/path/child_process/os, constructs a dotted-quad host string at runtime via repeated `.concat(x, '.')` calls, performs `axios.get(<url>)`, writes the response body to a file under `process.cwd()` with `{flag:'w+'}`, and spawns the written file via child_process with `windowsHide:true`. This is a download-and-execute dropper that fires automatically on `npm install`. Corroborating signals: package.json declares a self-referential floating dependency (`express-dever: ^5.1.7`), author and description fields are blank, and the README instructs readers to sandbox the file — consistent with a throwaway malicious upload rather than a legitimate library.