MAL-2026-11118 Malicious code in array-sort-helper (npm)

The npm postinstall script in [email protected] automatically runs on npm install and executes a shell reconnaissance and exfiltration routine. postinstall.js collects hostname, user, pwd, uname, container/docker markers, process tree, GitHub Actions CI variables (GITHUB_REPOSITORY, GITHUB_ACTOR, GITHUB_RUN_ID, RUNNER_NAME, CI), local IPs, /etc/resolv.conf, AWS and Tencent cloud instance-metadata (IMDS) probes, and a full dump of process environment variables (filtering only npm_* noise). The collected data is base64-encoded and sent via HTTP GET to a hardcoded Burp Collaborator subdomain at pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com/z?d=<base64>. The package presents itself as an array-sort utility but ships no such functionality; index.js contains unrelated color helper code. The behavior is credential and secret harvesting targeted at CI runners and cloud workloads.

The OpenSSF Package Analysis project identified 'array-sort-helper' @ 1.0.0 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.

• The package executes one or more commands associated with malicious behavior.