MAL-2026-17179

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (4135dd91724bdca6fc36f3a49906d219acc67afde7802cb1bd114d128984ca3d) The package's postinstall hook runs `node./loader.js`, which base64-decodes an ~8 KB embedded blob, XOR-decrypts it with a hardcoded 32-byte key, and pipes the resulting bytes into a detached, window-hidden `python -c -` child process via stdin. The loader also silently `pip install`s `requests` if missing. The advertised library surface in `index.js` is an explicit stub whose `connect()` throws, and `package.json` restricts installation to `os: ["win32"]`, so the tarball has no functional wallet-adapter behavior — its only effect on install is to execute the obfuscated Python payload on a Windows developer's machine. The combination of a hidden opaque payload, XOR-obfuscated delivery, detached hidden Python execution at `npm install` time, an inert cover-story main module, and OS pinning to Windows is a targeted install-time dropper.