MAL-2026-12355 Malicious code in com.db.dbk.ui-forms (npm)

[email protected] is a version-inflated package published to the public npm registry under a scope that resembles an internal namespace. Its package.json declares preinstall: node index.js, which runs automatically on npm install. index.js collects host identifiers (os.hostname(), os.platform(), os.userInfo(), homedir, network interfaces) and the output of shell commands (uname, id, whoami) via child_process, and enumerates process.env for keys matching /key|token|secret|pass|auth|cred|npm|ci|build|jenkins|github|gitlab|aws|azure/i. The collected payload is POSTed via https.request/http.request to the hardcoded interactsh callback host ycwyyoimdcluajepubahl0tpb7943a2z4.oast.fun at path /dcf/<pkg>, with a base64-chunked copy also emitted via DNS lookups to the same host. The package.json self-describes as a dependency confusion proof of concept; the installer-side behavior is exfiltration regardless of that framing.