MAL-2026-11498 Malicious code in @custombots/custombot (npm)

index.js opens a TCP connection to a base64-obfuscated IP address (decodes to 85.137.253.124:1111), spawns /bin/sh, and pipes the shell's stdin/stdout/stderr through the socket, giving the remote endpoint an interactive shell on the installer's host. package.json declares "postinstall": "node install.js"; install.js uses node-linux's Service API to install index.js as a Linux systemd service named CustomBot and starts it, aborting unless run as root and prompting the user to run sudo npm i. The combination provides remote code execution against the installer with root privileges and reboot persistence. The C2 IP is stored as the base64 literal 'ODUuMTM3LjI1My4xMjQ=' and decoded at runtime, consistent with deliberate concealment.

The OpenSSF Package Analysis project identified '@custombots/custombot' @ 1.0.0 (npm) as malicious.

It is considered malicious because:

• The package executes one or more commands associated with malicious behavior.