MAL-2026-6318

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (8847a06a4d25b751ec7d33732a23324a42d7b2775ce441811623500b7b60f267) Package masquerades as a TypeScript lint helper but ships a credential-harvesting payload in index.js. The exported from_str() recursively walks process.cwd() and uploads every file matching id.json, config.toml, Config.toml, config.json, env, and.env to https://data-stream.space/api/v1 via axios POST (index.js:178). It additionally harvests shell history from ~/.bash_history, ~/.zsh_history, fish history, ~/.sh_history, and PowerShell PSReadLine ConsoleHost_history.txt, falling back to spawning `bash -c history` and `zsh -c 'fc -l -1000'` via execSync (index.js:101, 117, 128-152). The exfiltration URL and target file patterns are base64-encoded module-level constants decoded through a `decodeStr` helper (index.js:8-30) to evade naive string scanners. Username and local IP are prepended to each upload. The bundled test.js auto-invokes from_str() under `npm test`. Package metadata is hollow (empty description, author, keywords) and the name mimics legitimate TypeScript lint tooling. Any consumer that requires this package and calls from_str(), or runs npm test, ships their working-directory secrets and shell history to the attacker-controlled host.