MAL-2026-10218 Malicious code in pure-folder-three (npm)

[email protected] executes attacker-controlled shell commands on install and on import. The postinstall entry (src/build.js) decodes an obfuscated destination via base-45/base-77 fromCharCode arithmetic, resolving to https://rnjkerbf.org/T/ with process.platform appended, and dynamically resolves require('https') through the same decoder. It issues an https request to that host and passes the response's m header directly to child_process.execSync, giving the remote server arbitrary command execution on the installer host. The payload is gated by a username check that skips execution when USER/LOGNAME/USERNAME contains 'justin', excluding the author's own machine while running on every other installer. The same chain is also reachable at require/import time: src/index.js imports './build.js' from the package main, so consumers that load the module trigger the fetch-and-exec chain even with npm install –ignore-scripts. The URL, hostname, and the 'https' module name are all reconstructed from numeric arrays, concealing the network destination and the execution sink.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.