MAL-2026-12039 Malicious code in data-format-helper (npm)

The package advertises itself as a data-formatting utility but ships a postinstall.js that auto-executes on npm install and runs shell commands to collect installer/CI identity and secrets, then sends them to an attacker-controlled Burp Collaborator subdomain over plain HTTP. Observed collection includes hostname, whoami/id, sudo -l output, process and network state, GitHub Actions environment (GITHUB_TOKEN, GITHUB_REPOSITORY, GITHUB_ACTOR, RUN_ID and related), and any environment variables matching KEY|TOKEN|SECRET|NPM_TOKEN|AWS_|AZURE|GCP|GITHUB_TOKEN, each base64-encoded and sent via curl to http://pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com/. The script additionally probes cloud instance-metadata endpoints for AWS, Aliyun, GCP and Tencent and forwards the responses to the same collector. A separate phase probes the internal hostname tst.woa.com and base64-encodes the response body of an internal flag.html before sending it to the collector, indicating targeted reconnaissance against a specific internal (Tencent) environment consistent with a dependency-confusion decoy. The advertised 'data formatting utilities' description and benign color-helper index.js are cover metadata unrelated to the postinstall behavior.