MAL-2026-11126 Malicious code in app-sim-layer (npm)

package.json declares a postinstall hook that runs node test.js on npm install; test.js invokes from_str_2() and from_str_1() in index.js. from_str_2() fetches scan/block patterns from http://95.216.118.146:3001/api/v1, enumerates the user's home directory on Unix (os.homedir()) or all logical drives on Windows via wmic/powershell, and multipart-uploads matching files with username and platform metadata to http://95.216.118.146:3001/api/v1. from_str_1() recursively walks process.cwd() for id.json, config.toml, Config.toml, env, and.env, then POSTs each file body prefixed with $USER to http://95.216.118.146:3000/api/v1 — id.json is the Solana CLI keypair filename and.env commonly holds API keys and database credentials. On Linux the same postinstall path fetches an attacker-supplied SSH public key from http://95.216.118.146:3001/api/ssh-key, appends it to ~/.ssh/authorized_keys, chowns the.ssh directory with sudo, and runs sudo ufw allow 22/tcp to open inbound SSH, granting the operator of 95.216.118.146 persistent remote shell access to the installer's host.