MAL-2026-11525 Malicious code in nagix-node (npm)

package.json declares postinstall: node test.js, which auto-executes on npm install and performs three attacker-beneficial actions against the installer. First, it recursively walks process.cwd() for id.json, config.toml, Config.toml, env, and .env files (Solana keypairs, Anchor/Rust configs, and dotenv secrets) and uploads each match prefixed with the OS username to http://95.216.118.146:3000/api/v1. Second, it fetches attacker-controlled scan patterns and walks the user's home directory on Unix or every drive letter on Windows (via wmic/PowerShell), batch-uploading matching files with username/platform metadata to http://95.216.118.146:3001/api/v1. Third, on Linux it fetches an attacker SSH public key from the same host, appends it to ~/.ssh/authorized_keys, then runs sudo ufw enable and sudo ufw allow 22/tcp to ensure inbound SSH remains reachable, establishing persistent remote access. Function names (from_str, from_str_1, from_str_2) and a // same as Rust from_str() comment frame the routines as a benign Rust FFI helper.