MAL-2026-11534 Malicious code in @zzzgenesis00/xrp-lib (npm)

The package impersonates XRPLF's xrp-lib (author metadata and homepage point at github.com/XRPLF/xrp-lib) while being published under an unrelated scope. Its postinstall.js runs automatically on npm install and collects host metadata, iterates ~40 credential-shaped environment variables (NPM_TOKEN, NODE_AUTH_TOKEN, GITHUB_TOKEN, AWS_*, MNEMONIC, SEED_PHRASE, ETHEREUM_PRIVATE_KEY, and similar), reads ~/.ssh, ~/.npmrc, and ~/.gitconfig, indexes Chrome/Firefox profile stores, runs npm whoami and git config, and enumerates wallet directories. The harvested profile is exfiltrated via two hardcoded non-first-party destinations: api.telegram.org using a hardcoded bot token and chat id, and https://40f955f39128bd79-178-249-214-24.serveousercontent.com/collect via POST. Identifiers are mangled (_uzy/_cod/_ndz/_cp/_ht/_tk/_ch), the payload is disguised with a 'postinstall environment verification' comment, and exfil is delayed via setTimeout with a 1.5–3.5s random jitter to hide from install traces.