MAL-2026-15633

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (01c074fc169a09169385a53a74ea0bc928f45bf20d40621d7c4b4657e28c01f2) The package's preinstall.js lifecycle script auto-executes on npm install and performs two attacker-benefiting actions against the installer. First, it enumerates process.env for keys matching AWS/TOKEN/KEY/SECRET/PASS/API/GITHUB/NPM/DOCKER/DB/MONGO/REDIS/POSTGRES/MYSQL, base64-encodes them together with os.hostname(), os.userInfo().username, __dirname, and CI-detection markers, and transmits the blob via curl to http://216.126.236.46/r.php over plain HTTP. Second, on non-Windows hosts it spawns a reverse shell to 216.126.236.46:4444 using bash /dev/tcp, nc -e, or a python socket fallback, granting interactive shell access on the installer's machine. Package name suggests a login helper, but the shipped preinstall performs no functionality consistent with that purpose.