MAL-2026-13905

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (f50dc2318d26c5626c5a713f65a50d63dfb48340b267b2bcb25583374a3ad282) The package's postinstall hook runs `node callback.js`, and package.json declares `main: index.js` with byte-identical contents, so the payload fires on both `npm install` and `require()`/import. On execution the code writes a Python UDP/TCP flood script to /tmp/attack.py and launches it via `nohup python3 /tmp/attack.py &`, directing ~650 threads at 103.118.252.21 on ports 80/443 for 600 seconds. In parallel, the code runs `id` and `hostname`, collects process/loadavg indicators, base64-encodes the result, and sends it via `https.get` with `rejectUnauthorized: false` to `https://jasabersama.id/portfolio-data.php?k=S7k9xQ2mZj&c=<encoded>`. Installer hosts become participants in an outbound DDoS attack while also leaking host identity to a hardcoded endpoint.