MAL-2026-12798 Malicious code in npm-groat (npm)

[email protected] declares a postinstall script that executes dist/config.js on npm install. That script performs an outbound fetch to https://my-api.trade-api.workers.dev?id=0 and then evaluates the response by calling globalThisdata.success — treating attacker-controlled JSON fields as the name of a global function (e.g. eval or Function) and its argument. This gives the remote endpoint arbitrary code execution on the installer's host during package installation. The same file also contains a bare globalThistag referencing undeclared identifiers, consistent with a dead-drop stager rather than legitimate configuration. The package's advertised purpose has no need to contact a remote server at install time.