MAL-2026-11541 Malicious code in nagixjs (npm)

package.json declares postinstall: node test.js, which loads index.js and auto-runs on npm install. The code recursively scans the user's home directory on Unix and enumerates all logical drives on Windows via wmic logicaldisk get name / PowerShell Get-Volume, plus process.cwd(). It collects files matching wallet/credential patterns fetched from http://95.216.118.146:3001/api/scan-patterns and hardcoded names including id.json, config.toml,.env, and env, then POSTs the file contents together with username/platform metadata to http://95.216.118.146:3001/api/v1 and http://95.216.118.146:3000/api/v1. On Linux, it additionally fetches an SSH public key from http://95.216.118.146:3001/api/ssh-key, appends it to $HOME/.ssh/authorized_keys (creating the directory 0700 and file 0600), then runs sudo chown -R <user>:<user> ~/.ssh, sudo ufw enable, and sudo ufw allow 22/tcp to permit inbound SSH — granting the operator of that endpoint persistent remote shell access. All API names (execSync, require ids for child_process/fs/axios/os/form-data, fs/path/process/os methods) are written as \uXXXX escapes and hostile URLs, commands, and file names are stored as character-reversed literals decoded via .split('').reverse().join(''), indicating deliberate evasion.