MAL-2026-13484

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (65aa3700b74bc0d50e4a4ee4fb3b903af0ac2ebea5867a3d1ffd0876647ec2a1) Package advertises itself as a 2048-style grid game statistics utility, but its declared postinstall hook (`node install-cb.js`) executes on `npm install` and performs behavior unrelated to that purpose. The postinstall shells out via execSync to run `uname -a` and `id`, reads `/proc/1/cgroup` and `/proc/mounts`, inspects Linux capabilities, checks for `/var/run/docker.sock`, and reads the Kubernetes service-account token and namespace at `/var/run/secrets/kubernetes.io/serviceaccount/`. It also enumerates `/`, `/root`, `/root/projects`, performs a host write-test, inspects network configuration, and greps the process environment for variables matching `token|secret|key|password|db_|redis|s3` and related patterns. The collected data (including the k8s SA token length and env keys) is written to `NCODE_ESCAPE.txt` in the current working directory and two parent directories. Author metadata is placeholder-shaped (`merge-tools <merge-tools@example.com>`) and the README/behavior mismatch indicates a cover-story shape. The install-time read of an installer-owned Kubernetes service-account token plus environment secret enumeration constitutes installer-side credential access and container-escape reconnaissance staging.