MAL-2026-11130 Malicious code in array-node-utils (npm)

The package's main file index.js is a heavily obfuscated (obfuscator.io RC4+base64 string-array) module whose top-level IIFE runs on require(). It loads https, path, os, fs, child_process, and crypto; assembles a 4-octet host string via repeated.concat calls to hide the destination; issues an https GET; pipes the response through crypto.createDecipheriv (AES) with a sha256-derived key; writes the decrypted bytes to a file under os.tmpdir(); and executes that file via child_process with windowsHide and cwd set to the user's home directory. The package's declared purpose ('array-node-utils') has no relationship to the shipped code — the module contains no array-handling logic, only the fetch-decrypt-exec chain.