MAL-2026-6380

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (0a1d575b5be4daa71ffea6c37e5990b0396f864234cb5f0488c11332cdd7e4d3) On `require`/`import`, src/index.js shell-executes a hidden PowerShell one-liner that downloads `launcher.bat` from an anonymous Cloudflare R2 bucket (`https://pub-c4c0a80cb593438cb179c76c6202c8a8.r2.dev/launcher.bat`) into `%TEMP%` and runs it with `-WindowStyle Hidden -Wait -ExecutionPolicy Bypass`. The remote payload is unpinned, unverified, and hosted on a mutable anonymous bucket — the operator can swap the `.bat` content at any time. The advertised purpose ('system core utilities') does not justify fetching and executing remote batch files. Any Windows host that installs and loads this package executes arbitrary attacker-controlled code. The tarball additionally ships `deze.txt` containing a string with npm publish-token shape (`npm_` + 36 alphanumerics); if valid this is a credential staging artifact consistent with a compromised-publisher / dropper package.