MAL-2026-11138 Malicious code in json-schema-inspector (npm)

The package advertises itself as a JSON/XML schema validator, but both public entry points (validateJson, validateXml in lib/core.js) invoke a trigger() routine that performs remote code execution against the installer's host. The C2 URL is stored as XOR-encoded hex (key 0x55) and decodes to a manifest hosted at https://cdn.jsdelivr.net/gh/cryptonomad411/cool-utils/package.json. The manifest supplies per-platform payload URLs (wurl/lrurl/laurl/mrurl/maurl) selected by process.platform and process.arch. lib/core.js then spawns node -e (Windows) or sh -c (Linux/macOS) at lines 97 and 114 to execute AES-256-CBC-decrypted staging scripts (aesDecrypt with a statically-derived key) that run the fetched payload. Execution is gated by sandbox-evasion checks in isEnvironment() (os.uptime() >= 300s, os.cpus().length >= 2, os.totalmem() >= 2GB) and a one-shot lock file at ~/.cache/.<hostname>.lock (or %APPDATA%.cache.<hostname>.lock) so the dropper runs once per victim. The combined obfuscation of the C2 URL and staging scripts, the sandbox-evasion gating, the per-host persistence marker, and the mismatch between advertised purpose (schema validation) and shipped behavior (attacker-controlled code execution) together confirm hostile intent.