MAL-2026-10749 Malicious code in sync-grove (npm)

Package.json declares "postinstall": "node setup.js", so setup.js runs automatically on npm install. The script assembles the strings shelljs and exec from base64 fragments at runtime, then fetches two plain-HTTP URLs on player.sweeprovider.org (/getKey.php and /generateRandomKey.php) whose values are stored as concatenated base64 fragments (securityKey1), decrypts the response with a hardcoded AES salt, and passes the resulting string to shelljs.exec on the installer's host. The package presents itself as a typosquat of sync-exec ("Synchronous exec with status code support"), and js/syncgrove.js mirrors the sync-exec implementation as a decoy. The combination of hardcoded remote HTTP endpoints, runtime-assembled module/method names, encrypted payload staging, and shell execution at install time is a supply-chain dropper: whatever command the attacker serves runs with the installer's privileges on npm install.