MAL-2026-14372

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (d92da1d80f455caae769107e4b3ff99c003a296f1238728cfc5521d5be06c380) Package create-coin@20.1.1 registers a postinstall hook that runs build/payload.node.js during npm install. The script performs anti-analysis guards (bails out on CI/GitHub Actions env vars, /.dockerenv, container cgroups, or fewer than four environment variables), sleeps a randomized 10-30 seconds, then reads the installer's ~/.npmrc (or %USERPROFILE%\.npmrc), enumerates every process.env entry, and reads project files including package.json, package-lock.json,.env, and src/config.*. It also collects host reconnaissance via os.hostname(), os.userInfo(), and child_process output of uname/id, plus open localhost port probes. All collected data is POSTed over HTTPS to the hardcoded endpoint https://random-name.trycloudflare.com with rejectUnauthorized:false, and a.ran lock file is written for idempotency. Exceptions are swallowed and exit code is forced to 0 so npm install appears successful. The package.json description claims the package is a "netbsd-x64 build for esbuild" while the shipped code has no relationship to esbuild, indicating typosquat / platform-package impersonation of the esbuild family.