MAL-2026-12136 Malicious code in accounts-stores (npm)

The package advertises itself as a reactive state-management library but its index.js silently requires./setup at the end of module load inside a try/catch. setup.js schedules a next-tick bootstrap that collects a host fingerprint (os.hostname(), os.userInfo().username, process.cwd(), pid, platform, arch), derives an installId, and loads a ~76KB lib/telemetry.js runtime that POSTs data via https.request. The identifier reads are obfuscated via string-concatenation indirection (os"host"+"name", os"user"+"Info", os"plat"+"form", and a helper const _p=(k)=>osk), which is not consistent with legitimate telemetry SDKs. The destination host is not present as a plain literal in telemetry.js; the file imports dns and https and contains a ServiceDiscovery class that resolves the endpoint at runtime, hiding the exfiltration target from source inspection. Nothing in the advertised state-store API references telemetry, and no opt-in or configuration surface is exposed.