MAL-2026-11107 Malicious code in num-format-helper (npm)

Package advertises itself as a number/locale formatting helper but its postinstall.js runs automatically on npm install and shells out via child_process/exec to collect host identity (hostname, user, id, sudo, uname), GitHub Actions variables including GITHUB_TOKEN and GITHUB_REPOSITORY, a broad env dump filtered by a credential regex (KEY|TOKEN|SECRET|CREDENTIAL|KUBE|JENKINS|NPM|GEM|CARGO|AZURE|GCP|AWS_|GH_TOKEN|GITHUB_TOKEN), network interfaces, running processes, and cloud instance metadata (AWS 169.254.169.254, Aliyun 100.100.100.200, Tencent). The collected data is base64-encoded and sent via curl in a GET request to the hardcoded Burp Collaborator subdomain pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com. The shipped index.js is a trivial unrelated stub, confirming the package is a cover story for the install-time exfiltration payload.

The OpenSSF Package Analysis project identified 'num-format-helper' @ 1.0.0 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.

• The package executes one or more commands associated with malicious behavior.