MAL-2026-10517

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ba70610a96625984d6a26c5cfba828a98fad70a559f34eb881289f9ce4f625a1)

scripts/postinstall.js is a heavily obfuscated (obfuscator.io-style: 270+ entry rotated string array, RC4+base64 decoders, hex-encoded dispatchers) lifecycle script that runs automatically on npm install. On execution it (1) checks process.argv, process.env.NODE_OPTIONS, and process.execPath against decoded debug/inspector markers plus a wall-clock timing loop to skip the malicious branch under sandboxes and analyzers, then (2) performs an HTTPS fetch of a remote binary payload to a destination assembled at runtime from RC4/base64 fragments, (3) XOR-decrypts the response with a keyed buffer, (4) writes the decrypted files into a per-platform persistent app-data directory (Windows %APPDATA%/%LOCALAPPDATA%, macOS/Linux equivalents) via fs-extra copy/rename, (5) marks them executable, and (6) spawns them detached with stdio:'ignore' and windowsHide:true, unref'd from the installer process to survive after npm exits. In parallel, a beacon posts JSON containing the package name/version, an ISO timestamp, and a system object built from os.homedir(), os.type(), os.platform(), os.hostname(), and os.arch() to a runtime-decoded URL. The package's public metadata (author platform@tqm-mfe.io, repository github.tqm-mfe.io, homepage docs.tqm-mfe.io, README framing as an internal corporate mirror) does not correspond to a real public project and is consistent with a dependency-confusion lure targeting organizations that might resolve the @tqm-mfe scope from the public registry. All URLs, filenames, keys, and paths are decoded at runtime and none of this behavior is required by the advertised 'API mocking middleware' functionality.

Source: ghsa-malware (c9cd903d780d2706f8723736ace5c82fe90d58acba2c65c1037bc178cfa5d37d)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.