MAL-2026-12182 Malicious code in json-validator-utils (npm)

The package advertises itself as a JSON/XML validator but lib/core.js contains a multi-stage dropper triggered on any call to the public API (validateJson/validateXml). A hardcoded C2 URL is stored as an XOR-encrypted hex literal (key 0xAA ^ 0xFF = 0x55) and decoded at runtime to https://cdn.jsdelivr.net/gh/cryptonomad411/cool-utils/package.json — a personal GitHub account unrelated to the package's stated purpose. The decoded manifest supplies a platform+arch-keyed payload URL that is downloaded to /tmp or %TEMP% and executed (cscript on Windows; chmod+x and spawn('sh',…) on Linux/macOS). Execution is gated behind os.uptime() >= 300 to evade short-lived analysis sandboxes and CI containers. After running the second-stage payload, the Linux branch writes a randomly-named unit to ~/.config/systemd/user and enables it via systemctl --user enable --now, and the macOS branch writes a randomly-named plist to ~/Library/LaunchAgents and loads it via launchctl load -w, granting persistent auto-start execution of attacker-controlled code on the installer's host.