MAL-2026-12057 Malicious code in @zzzgenesis00/playwrite (npm)

The package @zzzgenesis00/playwrite is a typosquat of playwright. Its exported launch() returns empty stub methods, while postinstall.js (also loaded transitively via index.js) runs on npm install and require. It collects hostname, username, homedir, platform, cwd, node version, npm registry configuration and the output of npm whoami via execSync, and harvests credential-shaped environment variables including NPM_TOKEN, GITHUB_TOKEN, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, DOCKER_PASSWORD, GCLOUD_ACCESS_TOKEN and NPM_CONFIG. It enumerates ~/.ssh (id_rsa, id_ed25519, id_ecdsa and.pub files), reads ~/.npmrc and ~/.gitconfig, and scans Chrome, Chromium and Firefox profile directories for Cookies and Login Data. The collected data is JSON-POSTed over HTTPS to the hardcoded Serveo reverse-tunnel host 40f955f39128bd79-178-249-214-24.serveousercontent.com at path /collect, with a 2-second setTimeout delay and a try/catch wrapper commented to keep npm install silent on failure.